CVE-2023-22523 - Vulnerability Details - OpenCVE

This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Atlassian	Assets Discovery Cloud Assets Discovery Data Center Assets Discovery Data Server

Configuration 1 [-]

OR	cpe:2.3:a:atlassian:assets_discovery_cloud::::::::
	cpe:2.3:a:atlassian:assets_discovery_data_center::::::::
	cpe:2.3:a:atlassian:assets_discovery_data_center::::::::
	cpe:2.3:a:atlassian:assets_discovery_data_server::::::::
	cpe:2.3:a:atlassian:assets_discovery_data_server::::::::

No data.

References

Link	Providers
https://confluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery-1319248914.html
https://jira.atlassian.com/browse/JSDSERVER-14925

History

No history.

MITRE

Status: PUBLISHED

Assigner: atlassian

Published: 2023-12-06T05:00:02.793Z

Updated: 2024-08-02T10:13:48.923Z

Reserved: 2023-01-01T00:01:22.333Z

Link: CVE-2023-22523

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-12-06T05:15:10.087

Modified: 2024-11-21T07:44:58.633

Link: CVE-2023-22523

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-22523", "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "state": "PUBLISHED", "assignerShortName": "atlassian", "dateReserved": "2023-01-01T00:01:22.333Z", "datePublished": "2023-12-06T05:00:02.793Z", "dateUpdated": "2024-08-02T10:13:48.923Z"}, "containers": {"cna": {"affected": [{"vendor": "Atlassian", "product": "Assets Discovery Cloud", "versions": [{"version": "< 1.0.0", "status": "unaffected"}, {"version": ">= 1.0.0", "status": "affected"}, {"version": ">= 1.5.7.0", "status": "affected"}, {"version": ">= 1.5.7.1", "status": "affected"}, {"version": ">= 1.5.7.3", "status": "affected"}, {"version": ">= 1.5.7.4", "status": "affected"}, {"version": ">= 1.6.1.2", "status": "affected"}, {"version": ">= 1.6.2.0", "status": "affected"}, {"version": ">= 1.6.3.0", "status": "affected"}, {"version": ">= 1.6.4.0", "status": "affected"}, {"version": ">= 1.6.4.4", "status": "affected"}, {"version": ">= 1.7.0.0", "status": "affected"}, {"version": ">= 1.7.1.0", "status": "affected"}, {"version": ">= 1.7.2.0", "status": "affected"}, {"version": ">= 1.8.0.0", "status": "affected"}, {"version": ">= 1.8.1.1", "status": "affected"}, {"version": ">= 1.8.1.2", "status": "affected"}, {"version": ">= 1.8.1.3", "status": "affected"}, {"version": ">= 1.8.1.4", "status": "affected"}, {"version": ">= 1.8.1.5", "status": "affected"}, {"version": ">= 1.8.2.0", "status": "affected"}, {"version": ">= 2.0.0.0", "status": "affected"}, {"version": ">= 3.1.0", "status": "affected"}, {"version": ">= 3.1.1", "status": "affected"}, {"version": ">= 3.1.10", "status": "affected"}, {"version": ">= 3.1.11", "status": "affected"}, {"version": ">= 3.1.2", "status": "affected"}, {"version": ">= 3.1.3", "status": "affected"}, {"version": ">= 3.1.4", "status": "affected"}, {"version": ">= 3.1.5", "status": "affected"}, {"version": ">= 3.1.6", "status": "affected"}, {"version": ">= 3.1.7", "status": "affected"}, {"version": ">= 3.1.8", "status": "affected"}, {"version": ">= 3.1.9", "status": "affected"}, {"version": ">= 3.2.0", "status": "unaffected"}]}, {"vendor": "Atlassian", "product": "Assets Discovery Data Center", "versions": [{"version": "< 1.0.0", "status": "unaffected"}, {"version": ">= 1.0.0", "status": "affected"}, {"version": ">= 3.1.0", "status": "affected"}, {"version": ">= 3.1.1", "status": "affected"}, {"version": ">= 3.1.10", "status": "affected"}, {"version": ">= 3.1.11", "status": "affected"}, {"version": ">= 3.1.2", "status": "affected"}, {"version": ">= 3.1.3", "status": "affected"}, {"version": ">= 3.1.4", "status": "affected"}, {"version": ">= 3.1.5", "status": "affected"}, {"version": ">= 3.1.6", "status": "affected"}, {"version": ">= 3.1.7", "status": "affected"}, {"version": ">= 3.1.9", "status": "affected"}, {"version": ">= 6.0.0", "status": "affected"}, {"version": ">= 6.1.10", "status": "affected"}, {"version": ">= 6.1.11", "status": "affected"}, {"version": ">= 6.1.12", "status": "affected"}, {"version": ">= 6.1.13", "status": "affected"}, {"version": ">= 6.1.14", "status": "affected"}, {"version": ">= 6.1.9", "status": "affected"}, {"version": ">= 6.2.0", "status": "unaffected"}]}], "descriptions": [{"lang": "en", "value": "This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent."}], "problemTypes": [{"descriptions": [{"description": "RCE (Remote Code Execution)", "lang": "en", "type": "RCE (Remote Code Execution)"}]}], "references": [{"url": "https://confluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery-1319248914.html"}, {"url": "https://jira.atlassian.com/browse/JSDSERVER-14925"}], "credits": [{"lang": "en", "value": "Bug Bounty"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "providerMetadata": {"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian", "dateUpdated": "2023-12-06T15:30:00.483Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:13:48.923Z"}, "title": "CVE Program Container", "references": [{"url": "https://confluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery-1319248914.html", "tags": ["x_transferred"]}, {"url": "https://jira.atlassian.com/browse/JSDSERVER-14925", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:assets_discovery_cloud:*:*:*:*:*:*:*:*", "matchCriteriaId": "B605B443-2604-4D2D-99C2-EF7D955B1886", "versionEndExcluding": "3.2.0", "versionStartIncluding": "1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:assets_discovery_data_center:*:*:*:*:*:*:*:*", "matchCriteriaId": "6EE9C216-E2F8-4BDB-A67B-095AA0B19613", "versionEndIncluding": "3.1.11", "versionStartIncluding": "1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:assets_discovery_data_center:*:*:*:*:*:*:*:*", "matchCriteriaId": "C95EF896-3AE4-400B-B4BD-61D909D91B5B", "versionEndExcluding": "6.2.0", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:assets_discovery_data_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "63079045-C71C-4D37-9B05-BD3705B90B37", "versionEndIncluding": "3.1.11", "versionStartIncluding": "1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:assets_discovery_data_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "329E8EB1-FEAC-4C29-B443-4AB31D5DBC95", "versionEndExcluding": "6.2.0", "versionStartIncluding": "6.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent."}, {"lang": "es", "value": "Esta vulnerabilidad, si se explota, permite a un atacante realizar RCE (ejecuci\u00f3n remota de c\u00f3digo) privilegiada en m\u00e1quinas con el agente Assets Discovery instalado. La vulnerabilidad existe entre la aplicaci\u00f3n Assets Discovery (anteriormente conocida como Insight Discovery) y el agente Assets Discovery."}], "id": "CVE-2023-22523", "lastModified": "2024-11-21T07:44:58.633", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@atlassian.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-12-06T05:15:10.087", "references": [{"source": "security@atlassian.com", "tags": ["Vendor Advisory"], "url": "https://confluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery-1319248914.html"}, {"source": "security@atlassian.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/JSDSERVER-14925"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://confluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery-1319248914.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/JSDSERVER-14925"}], "sourceIdentifier": "security@atlassian.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}