Savignano SNotify up to 2.0.0 on Bitbucket Setting cross-site request forgery

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Savignano SNotify up to 2.0.0 on Bitbucket. The affected element is an unknown function of the component Setting Handler. This manipulation causes cross-site request forgery. The identification of this vulnerability is CVE-2023-50931. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Savignano SNotify up to 2.0.0 on Bitbucket and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Setting Handler. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect integrity. The summary by CVE is:

An issue was discovered in savignano S/Notify before 2.0.1 for Bitbucket. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Bitbucket, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.

The weakness was shared 01/09/2024. The advisory is shared at help.savignano.net. This vulnerability is known as CVE-2023-50931 since 12/15/2023. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available.

Upgrading to version 2.0.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-55662). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Savignano

Name

• SNotify

Version

• 2.0

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion