High severity · published Nov 7, 2023
CVE-2023-42361
Local File Inclusion vulnerability in Midori-global Better PDF Exporter for Jira Server and Jira Data Center v.10.3.0 and before allows an attacker to view arbitrary files and…
7.8
CVSS
0.8%
EPSS
No
On KEV
Description
Local File Inclusion vulnerability in Midori-global Better PDF Exporter for Jira Server and Jira Data Center v.10.3.0 and before allows an attacker to view arbitrary files and cause other impacts via use of crafted image during PDF export.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BP
Better Pdf Exporter · Midori-global
before 11.0.0; before 11.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-42361
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-42361
Third Party Advisory
https://gccybermonks.com/posts/pdfjira/
Product
https://marketplace.atlassian.com/apps/5167/better-pdf-exporter-for-jira?tab=versions&hosting=datacenter
Product
https://marketplace.atlassian.com/apps/5167/better-pdf-exporter-for-jira?tab=versions&hosting=server
More from Better Pdf Exporter
6.1
CVE-2022-36131
The Better PDF Exporter add-on 10.0.0 for Atlassian Jira is prone to stored XSS via a crafted description to the PDF Templates overview page