...

We have fixed the following two vulnerabilities in S/Notify for Jira, S/Notify for Confluence and S/Notify for Bitbucket

CSRF based vulnerability in S/Notify configuration pages

...

• you use S/Notify for Jira with Jira in a version before 9.0

• you use S/Notify for Jira with Jira Service Management before 5.0

• you use S/Notify for Confluence

• you use S/Notify for Bitbucket

For further clarity, this vulnerability does not apply in any of the following cases:

• you use S/Notify for Jira with in Jira in version 9.0 or newer 👍

• you use S/Notify for Jira with Jira Service Management in version 5.0 or newer 👍

Description

While an administrative user is logged on, the configuration settings of S/Notify can be modified using a CSRF attack.

...

If executed while an administrator is logged on to Jira, Confluence or Bitbucket, an attacker could use the vulnerability to modify the configuration of the S/Notify app on that host. This can especially lead to email notifications being no longer encrypted when they should be. We therefore recommend that you update S/Notify as soon as possible.

Assessment

This vulnerability is considered severe according to Bugcrowd’s Vulnerability Rating Taxonomy and has been assigned a CVSS 8.3 (high) rating in the Common Vulnerability Scoring System.

...

You would be affected when on one of the following conditions apply

• you use S/Notify for Jira with a Jira in a version before 9.0
  and you have enabled users to upload their own S/MIME certificate or PGP key

• you use S/Notify for Jira with Jira Service Management in a version before 5.0
  and you have enabled users to upload their own S/MIME certificate or PGP key

• you use S/Notify for Jira with Jira Service Management
  and you have enabled customers to upload their own S/MIME certificate or PGP key

• you use S/Notify for Confluence

• you use S/Notify for Bitbucket

For further clarity, this vulnerability does not apply in any of the following cases:

• in Jira: you use Jira in version 9.0 or newer 👍

• in Jira, Confluence, or Bitbucket: you have not enabled users to upload their own S/MIME certificate or PGP key 👍

• in Jira Service Management: you have not enabled users nor customers to upload their own S/MIME certificate or PGP key 👍

• in Jira Service Management: you use Jira Service Management in version 5.0 or newer
  and you have not enabled customers to upload their own S/MIME certificate or PGP key 👍

Description

While a user is logged on, the user’s or customer’s S/MIME certificate or PGP key can be replaced using a CSRF attack.

...