CVE-2023-50932 Cross-site request forgery in n/a
An attacker can trick a logged-in Confluence administrator into modifying S/Notify plugin settings via CSRF, potentially disabling email encryption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-50932?
CVE-2023-50932 is a high-severity vulnerability in n/a, published on 9 Jan 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in savignano S/Notify before 4.0.2 for Confluence. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Confluence, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.
Weakness: CWE-352
Which versions are affected by CVE-2023-50932?
It affects 1 product.
Products include Savignano S-Notify.
How do I fix CVE-2023-50932?
No fix has been published for CVE-2023-50932 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-50932 being exploited?
There is no known exploitation of CVE-2023-50932 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-5h84-92m9-v9r6.