CVE-2023-44384

Katalog CVE

CVSS 4.1 · Medium EPSS 0,53%

Kerentanan Insufficient Control Flow Management pada discourse jira. Skor CVSS 3.1 4.1 (Medium) menurut NVD.

Deskripsi (NVD)

Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administrator user can make an SSRF attack by setting the Jira URL to an arbitrary location and enabling the `discourse_jira_verbose_log` site setting. A moderator user could manipulate the request path to the Jira API, allowing them to perform arbitrary GET requests using the Jira API credentials, potentially with elevated permissions, used by the application.

Rincian

Terbit di NVD

6 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-691: Insufficient Control Flow Management
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse-jira/security/advisories/GHSA-pmv5-h2x6-35fh advisory vendor
• https://github.com/discourse/discourse-jira/commit/8a2d3ad228883199fd5f081cc93d173c88e2e48f patch
• https://github.com/discourse/discourse-jira/pull/50 patch