CVE-2023-50932: CSRF
An issue was discovered in savignano S/Notify before 4.0.2 for Confluence. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Confluence, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50932?
CVE-2023-50932 is rated as a medium severity vulnerability due to its potential for exploitation via a CSRF attack.
How do I fix CVE-2023-50932?
To mitigate CVE-2023-50932, upgrade S/Notify to version 4.0.2 or later.
What is a CSRF attack in the context of CVE-2023-50932?
In the context of CVE-2023-50932, a CSRF attack allows an attacker to make unauthorized changes to configuration settings while an admin user is logged in.
Who is affected by CVE-2023-50932?
CVE-2023-50932 affects users of savignano S/Notify versions prior to 4.0.2 that are integrated with Confluence.
Can an administrator unknowingly trigger an attack related to CVE-2023-50932?
Yes, an administrator can unknowingly trigger an attack by clicking a malicious link in an email.