github - ghsa-3xff-pwwp-wxh5

GHSA-3XFF-PWWP-WXH5

Vulnerability from github – Published: 2023-12-06 06:30 – Updated: 2023-12-06 06:30

Details

This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent.

Assets Discovery, which can be downloaded via Atlassian Marketplace, is a network scanning tool that can be used with or without an agent with Jira Service Management Cloud, Data Center or Server. It detects hardware and software that is connected to your local network and extracts detailed information about each asset. This data can then be imported into Assets in Jira Service Management to help you manage all of the devices and configuration items within your local network.

Severity ?

9.8 (Critical)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-22523"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-06T05:15:10Z",
    "severity": "CRITICAL"
  },
  "details": "This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent.\n\nAssets Discovery, which can be downloaded via Atlassian Marketplace, is a network scanning tool that can be used with or without an agent with Jira Service Management Cloud, Data Center or Server. It detects hardware and software that is connected to your local network and extracts detailed information about each asset. This data can then be imported into Assets in Jira Service Management to help you manage all of the devices and configuration items within your local network.",
  "id": "GHSA-3xff-pwwp-wxh5",
  "modified": "2023-12-06T06:30:19Z",
  "published": "2023-12-06T06:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22523"
    },
    {
      "type": "WEB",
      "url": "https://confluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery-1319248914.html"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-14893"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-14925"
    },
    {
      "type": "WEB",
      "url": "https://support.atlassian.com/jira-service-management-cloud/docs/install-asset-discovery-agents"
    },
    {
      "type": "WEB",
      "url": "https://support.atlassian.com/jira-service-management-cloud/docs/what-are-asset-discovery-agents"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2023-22523 (GCVE-0-2023-22523)

Vulnerability from cvelistv5 – Published: 2023-12-06 05:00 – Updated: 2024-08-02 10:13

Summary

Severity ?

9.8 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

RCE (Remote Code Execution)

Assigner

atlassian

References

URL

Tags

	https://confluence.atlassian.com/security/cve-202…
	https://jira.atlassian.com/browse/JSDSERVER-14925

Impacted products

Vendor

Product

Version

Atlassian

Assets Discovery Cloud

Unaffected: < 1.0.0
Affected: >= 1.0.0
Affected: >= 1.5.7.0
Affected: >= 1.5.7.1
Affected: >= 1.5.7.3
Affected: >= 1.5.7.4
Affected: >= 1.6.1.2
Affected: >= 1.6.2.0
Affected: >= 1.6.3.0
Affected: >= 1.6.4.0
Affected: >= 1.6.4.4
Affected: >= 1.7.0.0
Affected: >= 1.7.1.0
Affected: >= 1.7.2.0
Affected: >= 1.8.0.0
Affected: >= 1.8.1.1
Affected: >= 1.8.1.2
Affected: >= 1.8.1.3
Affected: >= 1.8.1.4
Affected: >= 1.8.1.5
Affected: >= 1.8.2.0
Affected: >= 2.0.0.0
Affected: >= 3.1.0
Affected: >= 3.1.1
Affected: >= 3.1.10
Affected: >= 3.1.11
Affected: >= 3.1.2
Affected: >= 3.1.3
Affected: >= 3.1.4
Affected: >= 3.1.5
Affected: >= 3.1.6
Affected: >= 3.1.7
Affected: >= 3.1.8
Affected: >= 3.1.9
Unaffected: >= 3.2.0

Atlassian

Assets Discovery Data Center

Unaffected: < 1.0.0
Affected: >= 1.0.0
Affected: >= 3.1.0
Affected: >= 3.1.1
Affected: >= 3.1.10
Affected: >= 3.1.11
Affected: >= 3.1.2
Affected: >= 3.1.3
Affected: >= 3.1.4
Affected: >= 3.1.5
Affected: >= 3.1.6
Affected: >= 3.1.7
Affected: >= 3.1.9
Affected: >= 6.0.0
Affected: >= 6.1.10
Affected: >= 6.1.11
Affected: >= 6.1.12
Affected: >= 6.1.13
Affected: >= 6.1.14
Affected: >= 6.1.9
Unaffected: >= 6.2.0

Credits

Bug Bounty

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T10:13:48.923Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://confluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery-1319248914.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jira.atlassian.com/browse/JSDSERVER-14925"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Assets Discovery Cloud",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "unaffected",
              "version": "\u003c 1.0.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.0.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.5.7.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.5.7.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.5.7.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.5.7.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.6.1.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.6.2.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.6.3.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.6.4.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.6.4.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.7.0.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.7.1.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.7.2.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.8.0.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.8.1.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.8.1.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.8.1.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.8.1.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.8.1.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.8.2.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.9"
            },
            {
              "status": "unaffected",
              "version": "\u003e= 3.2.0"
            }
          ]
        },
        {
          "product": "Assets Discovery Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "unaffected",
              "version": "\u003c 1.0.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.0.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.1.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.1.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.1.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.1.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.1.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.1.9"
            },
            {
              "status": "unaffected",
              "version": "\u003e= 6.2.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Bug Bounty"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "RCE (Remote Code Execution)",
              "lang": "en",
              "type": "RCE (Remote Code Execution)"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-06T15:30:00.483Z",
        "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "shortName": "atlassian"
      },
      "references": [
        {
          "url": "https://confluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery-1319248914.html"
        },
        {
          "url": "https://jira.atlassian.com/browse/JSDSERVER-14925"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
    "assignerShortName": "atlassian",
    "cveId": "CVE-2023-22523",
    "datePublished": "2023-12-06T05:00:02.793Z",
    "dateReserved": "2023-01-01T00:01:22.333Z",
    "dateUpdated": "2024-08-02T10:13:48.923Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-3XFF-PWWP-WXH5

CVE-2023-22523 (GCVE-0-2023-22523)

Tags

Sightings

Nomenclature