Vulnerability · Published Oct 6, 2023 · Assigned by GitHub_M

CVE-2023-44384Discourse-Jira could make SSRF attack by setting Jira URL to an arbitrary location

Medium 4.1

In plain English

A medium-severity security flaw in discourse-jira from discourse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)4.1Medium

Exploit odds (30 days)0.5%top 55.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administrator user can make an SSRF attack by setting the Jira URL to an arbitrary location and enabling the `discourse_jira_verbose_log` site setting. A moderator user could manipulate the request path to the Jira API, allowing them to perform arbitrary GET requests using the Jira API credentials, potentially with elevated permissions, used by the application.

Affected products (as reported)

Vendor	Product	Versions
discourse	discourse-jira	<= f11be4c

Weakness: CWE-691 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

References

https://github.com/discourse/discourse-jira/security/advisories/GHSA-pmv5-h2x6-35fh x_refsource_CONFIRM
https://github.com/discourse/discourse-jira/pull/50 x_refsource_MISC
https://github.com/discourse/discourse-jira/commit/8a2d3ad228883199fd5f081cc93d173c88e2e48f x_refsource_MISC