Impersonation Vulnerability in Jira Service Management by Atlassian

CVE-2023-22501

Summary

An authentication flaw has been identified in Jira Service Management Server and Data Center which allows an attacker to impersonate legitimate users. Under specific conditions, particularly when write access is provided to a User Directory and outgoing email is active, attackers can exploit vulnerabilities to gain access to signup tokens for accounts that have never logged in. This can occur if the attacker interacts with Jira issues or requests a user is involved in, or if the attacker successfully intercepts emails with 'View Request' links sent to those users. Accounts with bot privileges and those associated with external single sign-on are especially vulnerable, making proper safeguards essential for maintaining user integrity.

References