High severity · published Jul 5, 2023
CVE-2023-30607
icingaweb2-module-jira provides integration with Atlassian Jira
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field configuration forms perform the deletion action before user input is validated, including the cross site request forgery token. This issue is fixed in version 1.3.2. There are no known workarounds.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IW
Icinga Web Jira Integration · Icinga
1.3.0 before 1.3.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-30607
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-30607
Patch
https://github.com/Icinga/icingaweb2-module-jira/commit/7f0c53b7a3e87be2f4c2e8840805d7b7c9762424
Release Notes
https://github.com/Icinga/icingaweb2-module-jira/releases/tag/v1.3.2
Vendor Advisory
https://github.com/Icinga/icingaweb2-module-jira/security/advisories/GHSA-gh7w-7f7j-gwp5