icingaweb2-module-jira template and field configuration are susceptible to CSRF
CVE-2023-30607

5MEDIUM

Key Information:

Vendor

Icinga

Status
Icingaweb2-module-jira
Vendor
CVE Published:
5 July 2023

What is CVE-2023-30607?

icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field configuration forms perform the deletion action before user input is validated, including the cross site request forgery token. This issue is fixed in version 1.3.2. There are no known workarounds.

Affected Version(s)

icingaweb2-module-jira >= 1.3.0, < 1.3.2

References

https://github.com/Icinga/icingaweb2-module-jira/security...
x_refsource_CONFIRM
https://github.com/Icinga/icingaweb2-module-jira/commit/7...
x_refsource_MISC
https://github.com/Icinga/icingaweb2-module-jira/releases...
x_refsource_MISC

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.