CVE-2023-30607
Assigner: GitHub_M
Published: 2023-07-05T17:42:54.496Z
State: PUBLISHED
title: icingaweb2-module-jira template and field configuration are susceptible to CSRF
problemTypes: descriptions: cweId: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
type: CWE
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
affected: vendor: Icinga
product: icingaweb2-module-jira
versions: version: >= 1.3.0, < 1.3.2
status: affected
descriptions: value: icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field configuration forms perform the deletion action before user input is validated, including the cross site request forgery token. This issue is fixed in version 1.3.2. There are no known workarounds.
source: advisory: GHSA-gh7w-7f7j-gwp5
discovery: UNKNOWN