PT-2023-22805 · Atlassian · Jira

Nilmerg · Published 2023-07-05 · Updated 2023-07-11 · CVE-2023-30607

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions icingaweb2-module-jira versions 1.3.0 through 1.3.2

Description The issue affects the integration with Atlassian Jira, where template and field configuration forms perform deletion actions before validating user input, including the cross-site request forgery token. This allows for potential unauthorized actions. The problem is fixed in version 1.3.2.

Recommendations For versions 1.3.0 through 1.3.1, update to version 1.3.2 to resolve the issue. For version 1.3.2, no action is required as this version already contains the fix.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-30607

GHSA-GH7W-7F7J-GWP5

Affected Products

Jira

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30607.json · Exploit
• https://github.com/Icinga/icingaweb2-module-jira/commit/7f0c53b7a3e87be2f4c2e8840805d7b7c9762424 · Patch
• https://github.com/Icinga/icingaweb2-module-jira/security/advisories/GHSA-gh7w-7f7j-gwp5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30607 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30607 · Vendor Advisory
• https://github.com/Icinga/icingaweb2-module-jira/releases/tag/v1.3.2 · Note
• https://t.me/cvenotify/54100 · Telegram Post
• https://t.me/cibsecurity/66008 · Telegram Post