CVE-2023-30607: icingaweb2-module-jira template and field configuration are susceptible to CSRF
icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field configuration forms perform the deletion action before user input is validated, including the cross site request forgery token. This issue is fixed in version 1.3.2. There are no known workarounds.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-30607?
CVE-2023-30607 is a vulnerability in the icingaweb2-module-jira integration with Atlassian Jira, where the deletion action is performed before user input is validated, including the cross-site request forgery token.
What is the severity of CVE-2023-30607?
CVE-2023-30607 has a severity of 8.8 (high).
How does CVE-2023-30607 affect the software?
CVE-2023-30607 affects Icinga Icinga Web Jira Integration version 1.3.0 to 1.3.2.
How can I fix CVE-2023-30607?
To fix CVE-2023-30607, upgrade to version 1.3.2 of Icinga Icinga Web Jira Integration.
Is there any additional information about CVE-2023-30607?
Yes, additional information about CVE-2023-30607 can be found in the Icinga Icinga Web Jira Integration repository and the associated security advisories.