CVE-2023-30607CWE-352

icingaweb2-module-jira template and field configuration are susceptible to CSRF

Medium · published July 5, 2023

CVSS v3.1
5.0
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field configuration forms perform the deletion action before user input is validated, including the cross site request forgery token. This issue is fixed in version 1.3.2. There are no known workarounds.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00263 · 17.1th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2023-07-05T17:42Z
EPSS history
Timeline
  • 05 JUL 17:42Z
    icingaweb2-module-jira template and field configuration are susceptible to CSRF
    cvelistv5