cvelistv5 - cve-2023-22501

▼	URL	Tags
	security@atlassian.com	https://jira.atlassian.com/browse/JSDSERVER-12312	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://jira.atlassian.com/browse/JSDSERVER-12312	Vendor Advisory

gsd-2023-22501

Vulnerability from gsd

Modified

2023-12-13 01:20

Details

An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain access to a Jira Service Management instance under certain circumstances_._ With write access to a User Directory and outgoing email enabled on a Jira Service Management instance, an attacker could gain access to signup tokens sent to users with accounts that have never been logged into. Access to these tokens can be obtained in two cases: * If the attacker is included on Jira issues or requests with these users, or * If the attacker is forwarded or otherwise gains access to emails containing a “View Request” link from these users. Bot accounts are particularly susceptible to this scenario. On instances with single sign-on, external customer accounts can be affected in projects where anyone can create their own account.

Aliases

CVE-2023-22501

Aliases

CVE-2023-22501

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-22501",
    "id": "GSD-2023-22501"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-22501"
      ],
      "details": "An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain access to a Jira Service Management instance under certain circumstances_._ With write access to a User Directory and outgoing email enabled on a Jira Service Management instance, an attacker could gain access to signup tokens sent to users with accounts that have never been logged into. Access to these tokens can be obtained in two cases: * If the attacker is included on Jira issues or requests with these users, or * If the attacker is forwarded or otherwise gains access to emails containing a \u201cView Request\u201d link from these users. Bot accounts are particularly susceptible to this scenario. On instances with single sign-on, external customer accounts can be affected in projects where anyone can create their own account.",
      "id": "GSD-2023-22501",
      "modified": "2023-12-13T01:20:42.552516Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@atlassian.com",
        "ID": "CVE-2023-22501",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Jira Service Management Data Center",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "!",
                          "version_value": "before 5.3.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "before 5.3.3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "before 5.4.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "before 5.5.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "before 5.6.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Jira Service Management Server",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "!",
                          "version_value": "before 5.3.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "before 5.3.3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "before 5.4.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "before 5.5.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "before 5.6.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Atlassian"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Atlassian"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain access to a Jira Service Management instance under certain circumstances_._ With write access to a User Directory and outgoing email enabled on a Jira Service Management instance, an attacker could gain access to signup tokens sent to users with accounts that have never been logged into. Access to these tokens can be obtained in two cases: * If the attacker is included on Jira issues or requests with these users, or * If the attacker is forwarded or otherwise gains access to emails containing a \u201cView Request\u201d link from these users. Bot accounts are particularly susceptible to this scenario. On instances with single sign-on, external customer accounts can be affected in projects where anyone can create their own account."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.0"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "BASM (Broken Authentication \u0026 Session Management)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://jira.atlassian.com/browse/JSDSERVER-12312",
            "refsource": "MISC",
            "url": "https://jira.atlassian.com/browse/JSDSERVER-12312"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.3.3",
                "versionStartIncluding": "5.3.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.4.2",
                "versionStartIncluding": "5.4.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:atlassian:jira_service_management:5.5.0:*:*:*:data_center:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:atlassian:jira_service_management:5.5.0:*:*:*:server:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.4.2",
                "versionStartIncluding": "5.4.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.3.3",
                "versionStartIncluding": "5.3.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@atlassian.com",
          "ID": "CVE-2023-22501"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain access to a Jira Service Management instance under certain circumstances_._ With write access to a User Directory and outgoing email enabled on a Jira Service Management instance, an attacker could gain access to signup tokens sent to users with accounts that have never been logged into. Access to these tokens can be obtained in two cases: * If the attacker is included on Jira issues or requests with these users, or * If the attacker is forwarded or otherwise gains access to emails containing a \u201cView Request\u201d link from these users. Bot accounts are particularly susceptible to this scenario. On instances with single sign-on, external customer accounts can be affected in projects where anyone can create their own account."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-287"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jira.atlassian.com/browse/JSDSERVER-12312",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://jira.atlassian.com/browse/JSDSERVER-12312"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.2
        }
      },
      "lastModifiedDate": "2023-02-09T14:48Z",
      "publishedDate": "2023-02-01T19:15Z"
    }
  }
}

wid-sec-w-2023-0258

Vulnerability from csaf_certbund

Published

2023-02-01 23:00

Modified

2023-02-05 23:00

Summary

Atlassian Jira Service Management Server and Data Center: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Jira ist eine Webanwendung zur Softwareentwicklung.

Angriff

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Atlassian Jira Service Management Server and Data Center ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

Betroffene Betriebssysteme

- UNIX - Linux - Windows - Sonstiges

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Jira ist eine Webanwendung zur Softwareentwicklung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Atlassian Jira Service Management Server and Data Center ausnutzen, um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- UNIX\n- Linux\n- Windows\n- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-0258 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0258.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-0258 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0258"
      },
      {
        "category": "external",
        "summary": "Atlassian Jira Security Advisory vom 2023-02-01",
        "url": "https://confluence.atlassian.com/jira/jira-service-management-server-and-data-center-advisory-cve-2023-22501-1188786458.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Atlassian Jira Service Management Server and Data Center: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen",
    "tracking": {
      "current_release_date": "2023-02-05T23:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:42:54.184+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-0258",
      "initial_release_date": "2023-02-01T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-02-01T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-02-05T23:00:00.000+00:00",
          "number": "2",
          "summary": "Pr\u00e4zisierung Softwareangabe in Titel und Zusammenfassung"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Atlassian Jira Software Jira Service Management Server and Data Center \u003c 5.3.3",
                "product": {
                  "name": "Atlassian Jira Software Jira Service Management Server and Data Center \u003c 5.3.3",
                  "product_id": "T026082",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:jira_software:jira_service_management_server_and_data_center__5.3.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Atlassian Jira Software Jira Service Management Server and Data Center \u003c 5.4.2",
                "product": {
                  "name": "Atlassian Jira Software Jira Service Management Server and Data Center \u003c 5.4.2",
                  "product_id": "T026083",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:jira_software:jira_service_management_server_and_data_center__5.4.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Atlassian Jira Software Jira Service Management Server and Data Center \u003c 5.5.1",
                "product": {
                  "name": "Atlassian Jira Software Jira Service Management Server and Data Center \u003c 5.5.1",
                  "product_id": "T026084",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:jira_software:jira_service_management_server_and_data_center__5.5.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Atlassian Jira Software Jira Service Management Server and Data Center \u003c 5.6.0",
                "product": {
                  "name": "Atlassian Jira Software Jira Service Management Server and Data Center \u003c 5.6.0",
                  "product_id": "T026085",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:jira_software:jira_service_management_server_and_data_center__5.6.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Jira Software"
          }
        ],
        "category": "vendor",
        "name": "Atlassian"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-22501",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Atlassian Jira Software. Dabei handelt es sich um eine Authentifizierungsschwachstelle, die es einem Angreifer erm\u00f6glicht, sich als ein anderer Benutzer auszugeben und unter bestimmten Umst\u00e4nden Zugriff auf eine Jira Service Management-Instanz zu erhalten. Ein Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsvorkehrungen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T026085",
          "T026084",
          "T026083",
          "T026082"
        ]
      },
      "release_date": "2023-02-01T23:00:00.000+00:00",
      "title": "CVE-2023-22501"
    }
  ]
}

ghsa-jm25-87xp-4h76

Vulnerability from github

Published

2023-07-06 19:24

Modified

2024-10-01 18:31

Severity ?

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain access to a Jira Service Management instance under certain circumstances_._ With write access to a User Directory and outgoing email enabled on a Jira Service Management instance, an attacker could gain access to signup tokens sent to users with accounts that have never been logged into. Access to these tokens can be obtained in two cases: * If the attacker is included on Jira issues or requests with these users, or * If the attacker is forwarded or otherwise gains access to emails containing a “View Request” link from these users. Bot accounts are particularly susceptible to this scenario. On instances with single sign-on, external customer accounts can be affected in projects where anyone can create their own account.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-22501"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-01T19:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain access to a Jira Service Management instance under certain circumstances_._ With write access to a User Directory and outgoing email enabled on a Jira Service Management instance, an attacker could gain access to signup tokens sent to users with accounts that have never been logged into. Access to these tokens can be obtained in two cases: * If the attacker is included on Jira issues or requests with these users, or * If the attacker is forwarded or otherwise gains access to emails containing a \u201cView Request\u201d link from these users. Bot accounts are particularly susceptible to this scenario. On instances with single sign-on, external customer accounts can be affected in projects where anyone can create their own account.",
  "id": "GHSA-jm25-87xp-4h76",
  "modified": "2024-10-01T18:31:15Z",
  "published": "2023-07-06T19:24:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22501"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-12312"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

cve-2023-22501

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature

Action not permitted

cve-2023-22501

Vulnerability from cvelistv5

gsd-2023-22501

Vulnerability from gsd

wid-sec-w-2023-0258

Vulnerability from csaf_certbund

ghsa-jm25-87xp-4h76

Vulnerability from github

Tags

Sightings

Nomenclature