CVE-2023-30607: icingaweb2-module-jira template and field configuration are susceptible to CSRF
First published: Wed Jul 05 2023(Updated: )
icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field configuration forms perform the deletion action before user input is validated, including the cross site request forgery token. This issue is fixed in version 1.3.2. There are no known workarounds.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Icinga Icinga Web Jira Integration | >=1.3.0<1.3.2 |
Remedy
https://github.com/Icinga/icingaweb2-module-jira/commit/7f0c53b7a3e87be2f4c2e8840805d7b7c9762424
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-30607?
CVE-2023-30607 is a vulnerability in the icingaweb2-module-jira integration with Atlassian Jira, where the deletion action is performed before user input is validated, including the cross-site request forgery token.
What is the severity of CVE-2023-30607?
CVE-2023-30607 has a severity of 8.8 (high).
How does CVE-2023-30607 affect the software?
CVE-2023-30607 affects Icinga Icinga Web Jira Integration version 1.3.0 to 1.3.2.
How can I fix CVE-2023-30607?
To fix CVE-2023-30607, upgrade to version 1.3.2 of Icinga Icinga Web Jira Integration.
Is there any additional information about CVE-2023-30607?
Yes, additional information about CVE-2023-30607 can be found in the Icinga Icinga Web Jira Integration repository and the associated security advisories.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/author
- agent/references
- agent/severity
- agent/title
- agent/weakness
- agent/remedy
- agent/event
- agent/first-publish-date
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- vendor/icinga
- canonical/icinga icinga web jira integration
- version/icinga icinga web jira integration/1.3.0