CVE-2023-44384

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-44384

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-44384.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2023-44384

Aliases

GHSA-pmv5-h2x6-35fh

Published

2023-10-06T17:15:57.596Z

Modified

2025-11-29T14:44:16.711954Z

Severity

4.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N CVSS Calculator

Summary

Discourse-Jira could make SSRF attack by setting Jira URL to an arbitrary location

Details

Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administrator user can make an SSRF attack by setting the Jira URL to an arbitrary location and enabling the discourse_jira_verbose_log site setting. A moderator user could manipulate the request path to the Jira API, allowing them to perform arbitrary GET requests using the Jira API credentials, potentially with elevated permissions, used by the application.

Database specific

{
    "cwe_ids": [
        "CWE-691"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/44xxx/CVE-2023-44384.json"
}

References

Affected packages

Git / github.com/discourse/discourse-jira

Affected ranges

Type: GIT
Repo: https://github.com/discourse/discourse-jira
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

8a2d3ad228883199fd5f081cc93d173c88e2e48f

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-44384.json"