What is CVE-2023-44384?

CVE-2023-44384 is a vulnerability in the Discourse-jira plugin that allows an administrator user to perform a Server-Side Request Forgery (SSRF) attack by manipulating the Jira URL.

How severe is CVE-2023-44384?

CVE-2023-44384 has a severity rating of 4.1, which is classified as medium.

What is Discourse-jira?

Discourse-jira is a plugin for Discourse that enables synchronization of Jira projects, issue types, fields, and field options.

What is an SSRF attack?

SSRF stands for Server-Side Request Forgery, which is a type of vulnerability that allows an attacker to make requests from the vulnerable server to internal or external network resources.

How can an administrator user perform an SSRF attack using CVE-2023-44384?

An administrator user can perform an SSRF attack by setting the Jira URL to a malicious location and enabling the `discourse_jira_verbose_log` site setting.

Vulnerability/
CVE-2023-44384

medium

4.1

CWE

918 691

6/10/2023

19/9/2024

CVE-2023-44384: Discourse-Jira could make SSRF attack by setting Jira URL to an arbitrary location

First published: Fri Oct 06 2023(Updated: )

Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administrator user can make an SSRF attack by setting the Jira URL to an arbitrary location and enabling the `discourse_jira_verbose_log` site setting. A moderator user could manipulate the request path to the Jira API, allowing them to perform arbitrary GET requests using the Jira API credentials, potentially with elevated permissions, used by the application.

Credit: security-advisories@github.com security-advisories@github.com

Affected Software	Affected Version	How to fix
Discourse Discourse Jira	<=2023-10-01

Remedy

https://github.com/discourse/discourse-jira/commit/8a2d3ad228883199fd5f081cc93d173c88e2e48f

Remedy

https://github.com/discourse/discourse-jira/pull/50

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2023-44384?
CVE-2023-44384 is a vulnerability in the Discourse-jira plugin that allows an administrator user to perform a Server-Side Request Forgery (SSRF) attack by manipulating the Jira URL.
How severe is CVE-2023-44384?
CVE-2023-44384 has a severity rating of 4.1, which is classified as medium.
What is Discourse-jira?
Discourse-jira is a plugin for Discourse that enables synchronization of Jira projects, issue types, fields, and field options.
What is an SSRF attack?
SSRF stands for Server-Side Request Forgery, which is a type of vulnerability that allows an attacker to make requests from the vulnerable server to internal or external network resources.
How can an administrator user perform an SSRF attack using CVE-2023-44384?
An administrator user can perform an SSRF attack by setting the Jira URL to a malicious location and enabling the `discourse_jira_verbose_log` site setting.

collector/nvd-api
collector/nvd-index
agent/author
agent/type
agent/remedy
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/severity
agent/weakness
agent/last-modified-date
agent/references
agent/title
agent/tags
agent/description
agent/first-publish-date
agent/event
vendor/discourse
canonical/discourse discourse jira
version/discourse discourse jira/2023-10-01

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.