PT-2024-14014 · Atlassian+1 · Bitbucket+1

Published 2024-01-08 · Updated 2026-01-06 · CVE-2023-50931

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AC:L/AV:N/A:L/C:H/I:H/PR:N/S:U/UI:R

Name of the Vulnerable Software and Affected Versions savignano S/Notify versions prior to 2.0.1 for Bitbucket

Description An issue was discovered that allows the configuration settings of S/Notify to be modified via a CSRF attack while an administrative user is logged on. This could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website, potentially leading to email notifications being no longer encrypted when they should be.

Recommendations For versions prior to 2.0.1, update to version 2.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the S/Notify configuration settings to minimize the risk of exploitation. Avoid using the S/Notify app on a host where an administrator is logged on to Bitbucket until the issue is resolved.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-50931

Affected Products

Bitbucket

S/Notify

References · 6

• https://osv.dev/vulnerability/CVE-2023-50931 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50931 · Security Note
• https://help.savignano.net/snotify-email-encryption/sa-2023-11-28 · Vendor Advisory
• https://twitter.com/CVEnew/status/1744610015154262380 · Twitter Post
• https://t.me/cveNotify/147899 · Telegram Post
• https://t.me/cvenotify/67769 · Telegram Post