CVE-2023-50930: CSRF
An issue was discovered in savignano S/Notify before 4.0.2 for Jira. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Jira, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50930?
The severity of CVE-2023-50930 is classified as a critical vulnerability due to its potential for exploitation through CSRF attacks.
How do I fix CVE-2023-50930?
To fix CVE-2023-50930, you should upgrade to S/Notify version 4.0.2 or later.
What could happen if CVE-2023-50930 is exploited?
If CVE-2023-50930 is exploited, an attacker could modify configuration settings of S/Notify while an administrative user is logged on.
Who is affected by CVE-2023-50930?
CVE-2023-50930 affects users of S/Notify for Jira versions prior to 4.0.2.
Is there a workaround for CVE-2023-50930?
Currently, the recommended mitigation for CVE-2023-50930 is to apply the available security update rather than seeking workarounds.