CVE search · CVE-2023-30607
CVE-2023-30607
high 8.8
icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field configuration forms perform the deletion action before user input is validated, including the cross site request forgery token. This issue is fixed in version 1.3.2. There are no known workarounds.
Details
- Status
- Modified
- Published
- Last changed
- Source
- security-advisories@github.com
- Weakness
- CWE-352
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | medium 5.0 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L |
security-advisories@github.comSecondary |
| CVSS 3.1 | high 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- icinga · icinga_web_jira_integration
References
- https://github.com/Icinga/icingaweb2-module-jira/commit/7f0c53b7a3e87be2f4c2e8840805d7b7c9762424Patch
- https://github.com/Icinga/icingaweb2-module-jira/releases/tag/v1.3.2Release Notes
- https://github.com/Icinga/icingaweb2-module-jira/security/advisories/GHSA-gh7w-7f7j-gwp5Vendor Advisory
- https://github.com/Icinga/icingaweb2-module-jira/commit/7f0c53b7a3e87be2f4c2e8840805d7b7c9762424Patch
- https://github.com/Icinga/icingaweb2-module-jira/releases/tag/v1.3.2Release Notes
- https://github.com/Icinga/icingaweb2-module-jira/security/advisories/GHSA-gh7w-7f7j-gwp5Vendor Advisory