PT-2024-14015 · Savignano · S/Notify

Published 2024-01-08 · Updated 2026-01-06 · CVE-2023-50932

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AC:L/AV:N/A:L/C:H/I:H/PR:N/S:U/UI:R

Name of the Vulnerable Software and Affected Versions savignano S/Notify versions prior to 4.0.2 for Confluence

Description An issue was discovered that allows the configuration settings of S/Notify to be modified via a CSRF attack while an administrative user is logged on. This could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed, an attacker could exploit this to modify the configuration of the S/Notify app, potentially leading to email notifications being no longer encrypted when they should be.

Recommendations For versions prior to 4.0.2, update to version 4.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the S/Notify configuration settings to minimize the risk of exploitation. Avoid using the S/Notify app until the issue is resolved.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-50932

Affected Products

S/Notify

References · 7

• https://osv.dev/vulnerability/CVE-2023-50932 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50932 · Security Note
• https://help.savignano.net/snotify-email-encryption/sa-2023-11-28 · Vendor Advisory
• https://t.me/cvenotify/125683 · Telegram Post
• https://t.me/cvenotify/67770 · Telegram Post
• https://twitter.com/CVEnew/status/1744610016030847245 · Twitter Post
• https://t.me/cveNotify/147900 · Telegram Post