Lucene search

[email protected]CVE-2023-52240

HistoryDec 29, 2023 - 10:15 p.m.

CVE-2023-52240

2023-12-2922:15:37

CWE-79

[email protected]

web.nvd.nist.gov

cwe-79

kantega saml

sso

oidc

kerberos

xss

atlassian products

cve-2023-52240

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.2%

JSON

The Kantega SAML SSO OIDC Kerberos Single Sign-on apps before 6.20.0 for Atlassian products allow XSS if SAML POST Binding is enabled. This affects 4.4.2 through 4.14.8 before 4.14.9, 5.0.0 through 5.11.4 before 5.11.5, and 6.0.0 through 6.19.0 before 6.20.0. The full product names are Kantega SAML SSO OIDC Kerberos Single Sign-on for Jira Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Confluence Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Bitbucket Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Bamboo Data Center & Server (Kantega SSO Enterprise), and Kantega SAML SSO OIDC Kerberos Single Sign-on for FeCru Server (Kantega SSO Enterprise). (Here, FeCru refers to the Atlassian Fisheye and Crucible products running together.)

Affected configurations

NVD

Node

kantega-ssokantega_saml_sso_oidc_kerberos_single_sign-onRange4.4.2–4.14.9bamboo

kantega-ssokantega_saml_sso_oidc_kerberos_single_sign-onRange4.4.2–4.14.9bitbucket

kantega-ssokantega_saml_sso_oidc_kerberos_single_sign-onRange4.4.2–4.14.9confluence

kantega-ssokantega_saml_sso_oidc_kerberos_single_sign-onRange4.4.2–4.14.9fecru

kantega-ssokantega_saml_sso_oidc_kerberos_single_sign-onRange4.4.2–4.14.9jira

kantega-ssokantega_saml_sso_oidc_kerberos_single_sign-onRange5.0.0–5.11.5bamboo

kantega-ssokantega_saml_sso_oidc_kerberos_single_sign-onRange5.0.0–5.11.5bitbucket

kantega-ssokantega_saml_sso_oidc_kerberos_single_sign-onRange5.0.0–5.11.5confluence

kantega-ssokantega_saml_sso_oidc_kerberos_single_sign-onRange5.0.0–5.11.5jira

kantega-ssokantega_saml_sso_oidc_kerberos_single_sign-onRange6.0.0–6.20.0bamboo

kantega-ssokantega_saml_sso_oidc_kerberos_single_sign-onRange6.0.0–6.20.0bitbucket

kantega-ssokantega_saml_sso_oidc_kerberos_single_sign-onRange6.0.0–6.20.0confluence

kantega-ssokantega_saml_sso_oidc_kerberos_single_sign-onRange6.0.0–6.20.0jira

CPENameOperatorVersion
kantega-sso:kantega_saml_sso_oidc_kerberos_single_sign-onkantega-sso kantega saml sso oidc kerberos single sign-onlt4.14.9
kantega-sso:kantega_saml_sso_oidc_kerberos_single_sign-onkantega-sso kantega saml sso oidc kerberos single sign-onlt5.11.5
kantega-sso:kantega_saml_sso_oidc_kerberos_single_sign-onkantega-sso kantega saml sso oidc kerberos single sign-onlt6.20.0

CPE	Name	Operator	Version
kantega-sso:kantega_saml_sso_oidc_kerberos_single_sign-on	kantega-sso kantega saml sso oidc kerberos single sign-on	lt	4.14.9
kantega-sso:kantega_saml_sso_oidc_kerberos_single_sign-on	kantega-sso kantega saml sso oidc kerberos single sign-on	lt	5.11.5
kantega-sso:kantega_saml_sso_oidc_kerberos_single_sign-on	kantega-sso kantega saml sso oidc kerberos single sign-on	lt	6.20.0

References

kantega-sso.atlassian.net/wiki/spaces/KSE/pages/1226473473/Security+Vulnerability+HTML+injection+Cross-site+scripting+in+SAML+POST+binding+Kantega+SSO+Enterprise

marketplace.atlassian.com/apps/1211923/kantega-saml-sso-oidc-kerberos-single-sign-on-for-jira?hosting=datacenter&tab=versions

marketplace.atlassian.com/apps/1212126/kantega-saml-sso-oidc-kerberos-single-sign-on-for-confluence?hosting=datacenter&tab=overview

marketplace.atlassian.com/apps/1213019/kantega-saml-sso-oidc-kerberos-single-sign-on-for-bitbucket?hosting=datacenter&tab=overview

marketplace.atlassian.com/apps/1215262/kantega-saml-sso-oidc-kerberos-single-sign-on-for-bamboo?hosting=datacenter&tab=overview

marketplace.atlassian.com/apps/1215263/kantega-saml-sso-oidc-kerberos-single-sign-on-for-fecru?hosting=server&tab=overview

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.2%

JSON

Related for CVE-2023-52240

nvd1 prion1 cvelist1