PT-2024-20045 · Savignano · S/Notify

Published 2024-07-01 · Updated 2024-07-11 · CVE-2024-23736

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions savignano S/Notify versions prior to 4.0.2 for Confluence

Description A Cross Site Request Forgery (CSRF) issue allows attackers to manipulate a user's S/MIME certificate or PGP key via malicious links or emails.

Recommendations For versions prior to 4.0.2, update to version 4.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive user settings until the update is applied. Avoid clicking on suspicious links or opening malicious emails to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-23736

Affected Products

S/Notify

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-23736 · Security Note
• https://t.me/cvenotify/84959 · Telegram Post
• https://help.savignano.net/snotify-email-encryption/sa-2023-11-28#SA-2023-11-28-CSRFbasedvulnerabilityinuserupload · Note
• https://t.me/cvenotify/85849 · Telegram Post