CVE-2023-44384
CVSS 3.1 Score 4.1 of 10 (medium)
Details
Summary
The vulnerability with the CVE ID name CVE-2023-44384 affects the Discourse-jira plugin, which allows synchronization between Discourse and Jira. An administrator user can exploit this vulnerability by setting the Jira URL to a malicious location and enabling the `discourse_jira_verbose_log` setting. This can lead to a Server Side Request Forgery (SSRF) attack. Furthermore, a moderator user can manipulate the request path to the Jira API, allowing them to perform unauthorized GET requests using Jira API credentials. This poses a potential danger as it could result in elevated permissions and unauthorized access to sensitive information within an organization. The severity of this vulnerability is rated as MEDIUM with a base score of 4.1, requiring high privileges to exploit and having low confidentiality impact. It is recommended to remediate this vulnerability by updating the affected products or applying relevant patches or fixes provided by the vendor.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions