CVE-2024-23737

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-23737
Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Jira allows attackers to allows attackers to manipulate a user's S/MIME certificate of PGP key via malicious link or email.

5.4 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://help.savignano.net/snotify-email-encryption/sa-2023-11-28#SA-2023-11-28-CSRFbasedvulnerabilityinuserupload Vendor Advisory
https://help.savignano.net/snotify-email-encryption/sa-2023-11-28#SA-2023-11-28-CSRFbasedvulnerabilityinuserupload Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:savignano:s-notify:*:*:*:*:*:jira:*:*
cpe:2.3:a:savignano:s-notify:*:*:*:*:*:confluence:*:*
cpe:2.3:a:savignano:s-notify:*:*:*:*:*:bitbucket:*:*
History

29 Aug 2024, 20:34

Type Values Removed Values Added
References () https://help.savignano.net/snotify-email-encryption/sa-2023-11-28#SA-2023-11-28-CSRFbasedvulnerabilityinuserupload - () https://help.savignano.net/snotify-email-encryption/sa-2023-11-28#SA-2023-11-28-CSRFbasedvulnerabilityinuserupload - Vendor Advisory
CWE CWE-352
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4
First Time Savignano
Savignano s-notify
CPE cpe:2.3:a:savignano:s-notify:*:*:*:*:*:jira:*:*
cpe:2.3:a:savignano:s-notify:*:*:*:*:*:confluence:*:*
cpe:2.3:a:savignano:s-notify:*:*:*:*:*:bitbucket:*:*

01 Jul 2024, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-01 22:15

Updated : 2025-03-18 15:15

NVD link : CVE-2024-23737

Mitre link : CVE-2024-23737

JSON object : View

Products Affected

savignano

  • s-notify
CWE
CWE-352

Cross-Site Request Forgery (CSRF)