CVE-2023-44384

Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administrator user can make an SSRF attack by setting the Jira URL to an arbitrary location and enabling the `discourse_jira_verbose_log` site setting. A moderator user could manipulate the request path to the Jira API, allowing them to perform arbitrary GET requests using the Jira API credentials, potentially with elevated permissions, used by the application.
Configurations

Configuration 1 (hide)

cpe:2.3:a:discourse:discourse_jira:*:*:*:*:*:discourse:*:*

History

11 Oct 2023, 17:49

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 4.1
References (MISC) https://github.com/discourse/discourse-jira/commit/8a2d3ad228883199fd5f081cc93d173c88e2e48f - (MISC) https://github.com/discourse/discourse-jira/commit/8a2d3ad228883199fd5f081cc93d173c88e2e48f - Patch
References (MISC) https://github.com/discourse/discourse-jira/security/advisories/GHSA-pmv5-h2x6-35fh - (MISC) https://github.com/discourse/discourse-jira/security/advisories/GHSA-pmv5-h2x6-35fh - Vendor Advisory
References (MISC) https://github.com/discourse/discourse-jira/pull/50 - (MISC) https://github.com/discourse/discourse-jira/pull/50 - Patch
CPE cpe:2.3:a:discourse:discourse_jira:*:*:*:*:*:discourse:*:*
CWE CWE-691 CWE-918
First Time Discourse
Discourse discourse Jira

06 Oct 2023, 19:41

Type Values Removed Values Added
New CVE

Information

Published : 2023-10-06 18:15

Updated : 2024-02-28 20:33


NVD link : CVE-2023-44384

Mitre link : CVE-2023-44384

CVE.ORG link : CVE-2023-44384


JSON object : View

Products Affected

discourse

  • discourse_jira
CWE
CWE-918

Server-Side Request Forgery (SSRF)

CWE-691

Insufficient Control Flow Management