CSRF in Savignano S-Notify
CVE-2023-50930
An issue was discovered in savignano S/Notify before 4.0.2 for Jira. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Jira, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.
Vulnerability class: CSRF (Cross-Site Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L.
EPSS exploit prediction
EPSS: 0.002 (8.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 8th percentile — 8.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
Weakness classification (CWE)
References
- help.savignano.net/snotify-email-encryption/sa-2023-11-28 (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-50930?
- CVE-2023-50930 is a high-severity vulnerability in Savignano S-Notify, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.3/10. Published 2024-01-09.
- How severe is CVE-2023-50930?
- High severity. CVSS v3 base score is 8.3 out of 10.