csaf_certbund - wid-sec-w-2023-0258

wid-sec-w-2023-0258

Vulnerability from csaf_certbund

Published

2023-02-01 23:00

Modified

2023-02-05 23:00

Summary

Atlassian Jira Service Management Server and Data Center: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Jira ist eine Webanwendung zur Softwareentwicklung.

Angriff

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Atlassian Jira Service Management Server and Data Center ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

Betroffene Betriebssysteme

- UNIX - Linux - Windows - Sonstiges

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Jira ist eine Webanwendung zur Softwareentwicklung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Atlassian Jira Service Management Server and Data Center ausnutzen, um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- UNIX\n- Linux\n- Windows\n- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-0258 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0258.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-0258 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0258"
      },
      {
        "category": "external",
        "summary": "Atlassian Jira Security Advisory vom 2023-02-01",
        "url": "https://confluence.atlassian.com/jira/jira-service-management-server-and-data-center-advisory-cve-2023-22501-1188786458.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Atlassian Jira Service Management Server and Data Center: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen",
    "tracking": {
      "current_release_date": "2023-02-05T23:00:00.000+00:00",
      "generator": {
        "date": "2024-02-15T17:12:39.421+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2023-0258",
      "initial_release_date": "2023-02-01T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-02-01T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-02-05T23:00:00.000+00:00",
          "number": "2",
          "summary": "Pr\u00e4zisierung Softwareangabe in Titel und Zusammenfassung"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Atlassian Jira Software Jira Service Management Server and Data Center \u003c 5.3.3",
                "product": {
                  "name": "Atlassian Jira Software Jira Service Management Server and Data Center \u003c 5.3.3",
                  "product_id": "T026082",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:jira_software:jira_service_management_server_and_data_center__5.3.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Atlassian Jira Software Jira Service Management Server and Data Center \u003c 5.4.2",
                "product": {
                  "name": "Atlassian Jira Software Jira Service Management Server and Data Center \u003c 5.4.2",
                  "product_id": "T026083",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:jira_software:jira_service_management_server_and_data_center__5.4.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Atlassian Jira Software Jira Service Management Server and Data Center \u003c 5.5.1",
                "product": {
                  "name": "Atlassian Jira Software Jira Service Management Server and Data Center \u003c 5.5.1",
                  "product_id": "T026084",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:jira_software:jira_service_management_server_and_data_center__5.5.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Atlassian Jira Software Jira Service Management Server and Data Center \u003c 5.6.0",
                "product": {
                  "name": "Atlassian Jira Software Jira Service Management Server and Data Center \u003c 5.6.0",
                  "product_id": "T026085",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:jira_software:jira_service_management_server_and_data_center__5.6.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Jira Software"
          }
        ],
        "category": "vendor",
        "name": "Atlassian"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-22501",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Atlassian Jira Software. Dabei handelt es sich um eine Authentifizierungsschwachstelle, die es einem Angreifer erm\u00f6glicht, sich als ein anderer Benutzer auszugeben und unter bestimmten Umst\u00e4nden Zugriff auf eine Jira Service Management-Instanz zu erhalten. Ein Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsvorkehrungen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T026085",
          "T026084",
          "T026083",
          "T026082"
        ]
      },
      "release_date": "2023-02-01T23:00:00Z",
      "title": "CVE-2023-22501"
    }
  ]
}

cve-2023-22501

Vulnerability from cvelistv5

Published

2023-02-01 18:00

Modified

2024-10-01 15:10

Severity ?

9.4 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Summary

An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain access to a Jira Service Management instance under certain circumstances_._ With write access to a User Directory and outgoing email enabled on a Jira Service Management instance, an attacker could gain access to signup tokens sent to users with accounts that have never been logged into. Access to these tokens can be obtained in two cases: * If the attacker is included on Jira issues or requests with these users, or * If the attacker is forwarded or otherwise gains access to emails containing a “View Request” link from these users. Bot accounts are particularly susceptible to this scenario. On instances with single sign-on, external customer accounts can be affected in projects where anyone can create their own account.

References

▼	URL	Tags
	https://jira.atlassian.com/browse/JSDSERVER-12312

Impacted products

▼	Vendor	Product
	Atlassian	Jira Service Management Data Center
	Atlassian	Jira Service Management Server

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T10:13:48.675Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jira.atlassian.com/browse/JSDSERVER-12312"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jira_service_management",
            "vendor": "atlassian",
            "versions": [
              {
                "lessThan": "5.3.3",
                "status": "affected",
                "version": "5.3.0",
                "versionType": "custom"
              },
              {
                "lessThan": "5.4.2",
                "status": "affected",
                "version": "5.4.0",
                "versionType": "custom"
              },
              {
                "status": "affected",
                "version": "5.5.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jira_service_management",
            "vendor": "atlassian",
            "versions": [
              {
                "lessThan": "5.3.3",
                "status": "affected",
                "version": "5.3.0",
                "versionType": "custom"
              },
              {
                "lessThan": "5.4.2",
                "status": "affected",
                "version": "5.4.0",
                "versionType": "custom"
              },
              {
                "status": "affected",
                "version": "5.5.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-22501",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-01T14:56:07.382799Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-287",
                "description": "CWE-287 Improper Authentication",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-01T15:10:37.485Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jira Service Management Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "unaffected",
              "version": "before 5.3.0"
            },
            {
              "status": "affected",
              "version": "before 5.3.3"
            },
            {
              "status": "affected",
              "version": "before 5.4.2"
            },
            {
              "status": "affected",
              "version": "before 5.5.1"
            },
            {
              "status": "affected",
              "version": "before 5.6.0"
            }
          ]
        },
        {
          "product": "Jira Service Management Server",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "unaffected",
              "version": "before 5.3.0"
            },
            {
              "status": "affected",
              "version": "before 5.3.3"
            },
            {
              "status": "affected",
              "version": "before 5.4.2"
            },
            {
              "status": "affected",
              "version": "before 5.5.1"
            },
            {
              "status": "affected",
              "version": "before 5.6.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Atlassian"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain access to a Jira Service Management instance under certain circumstances_._ With write access to a User Directory and outgoing email enabled on a Jira Service Management instance, an attacker could gain access to signup tokens sent to users with accounts that have never been logged into. Access to these tokens can be obtained in two cases:\n\n* If the attacker is included on Jira issues or requests with these users, or\n* If the attacker is forwarded or otherwise gains access to emails containing a \u201cView Request\u201d link from these users.\n\nBot accounts are particularly susceptible to this scenario. On instances with single sign-on, external customer accounts can be affected in projects where anyone can create their own account."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "BASM (Broken Authentication \u0026 Session Management)",
              "lang": "en",
              "type": "BASM (Broken Authentication \u0026 Session Management)"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-02-01T18:00:36.982Z",
        "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "shortName": "atlassian"
      },
      "references": [
        {
          "url": "https://jira.atlassian.com/browse/JSDSERVER-12312"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
    "assignerShortName": "atlassian",
    "cveId": "CVE-2023-22501",
    "datePublished": "2023-02-01T18:00:36.982Z",
    "dateReserved": "2023-01-01T00:01:22.328Z",
    "dateUpdated": "2024-10-01T15:10:37.485Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted