{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-22523", "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "state": "PUBLISHED", "assignerShortName": "atlassian", "dateReserved": "2023-01-01T00:01:22.333Z", "datePublished": "2023-12-06T05:00:02.793Z", "dateUpdated": "2024-08-02T10:13:48.923Z"}, "containers": {"cna": {"affected": [{"vendor": "Atlassian", "product": "Assets Discovery Cloud", "versions": [{"version": "< 1.0.0", "status": "unaffected"}, {"version": ">= 1.0.0", "status": "affected"}, {"version": ">= 1.5.7.0", "status": "affected"}, {"version": ">= 1.5.7.1", "status": "affected"}, {"version": ">= 1.5.7.3", "status": "affected"}, {"version": ">= 1.5.7.4", "status": "affected"}, {"version": ">= 1.6.1.2", "status": "affected"}, {"version": ">= 1.6.2.0", "status": "affected"}, {"version": ">= 1.6.3.0", "status": "affected"}, {"version": ">= 1.6.4.0", "status": "affected"}, {"version": ">= 1.6.4.4", "status": "affected"}, {"version": ">= 1.7.0.0", "status": "affected"}, {"version": ">= 1.7.1.0", "status": "affected"}, {"version": ">= 1.7.2.0", "status": "affected"}, {"version": ">= 1.8.0.0", "status": "affected"}, {"version": ">= 1.8.1.1", "status": "affected"}, {"version": ">= 1.8.1.2", "status": "affected"}, {"version": ">= 1.8.1.3", "status": "affected"}, {"version": ">= 1.8.1.4", "status": "affected"}, {"version": ">= 1.8.1.5", "status": "affected"}, {"version": ">= 1.8.2.0", "status": "affected"}, {"version": ">= 2.0.0.0", "status": "affected"}, {"version": ">= 3.1.0", "status": "affected"}, {"version": ">= 3.1.1", "status": "affected"}, {"version": ">= 3.1.10", "status": "affected"}, {"version": ">= 3.1.11", "status": "affected"}, {"version": ">= 3.1.2", "status": "affected"}, {"version": ">= 3.1.3", "status": "affected"}, {"version": ">= 3.1.4", "status": "affected"}, {"version": ">= 3.1.5", "status": "affected"}, {"version": ">= 3.1.6", "status": "affected"}, {"version": ">= 3.1.7", "status": "affected"}, {"version": ">= 3.1.8", "status": "affected"}, {"version": ">= 3.1.9", "status": "affected"}, {"version": ">= 3.2.0", "status": "unaffected"}]}, {"vendor": "Atlassian", "product": "Assets Discovery Data Center", "versions": [{"version": "< 1.0.0", "status": "unaffected"}, {"version": ">= 1.0.0", "status": "affected"}, {"version": ">= 3.1.0", "status": "affected"}, {"version": ">= 3.1.1", "status": "affected"}, {"version": ">= 3.1.10", "status": "affected"}, {"version": ">= 3.1.11", "status": "affected"}, {"version": ">= 3.1.2", "status": "affected"}, {"version": ">= 3.1.3", "status": "affected"}, {"version": ">= 3.1.4", "status": "affected"}, {"version": ">= 3.1.5", "status": "affected"}, {"version": ">= 3.1.6", "status": "affected"}, {"version": ">= 3.1.7", "status": "affected"}, {"version": ">= 3.1.9", "status": "affected"}, {"version": ">= 6.0.0", "status": "affected"}, {"version": ">= 6.1.10", "status": "affected"}, {"version": ">= 6.1.11", "status": "affected"}, {"version": ">= 6.1.12", "status": "affected"}, {"version": ">= 6.1.13", "status": "affected"}, {"version": ">= 6.1.14", "status": "affected"}, {"version": ">= 6.1.9", "status": "affected"}, {"version": ">= 6.2.0", "status": "unaffected"}]}], "descriptions": [{"lang": "en", "value": "This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent."}], "problemTypes": [{"descriptions": [{"description": "RCE (Remote Code Execution)", "lang": "en", "type": "RCE (Remote Code Execution)"}]}], "references": [{"url": "https://confluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery-1319248914.html"}, {"url": "https://jira.atlassian.com/browse/JSDSERVER-14925"}], "credits": [{"lang": "en", "value": "Bug Bounty"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "providerMetadata": {"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian", "dateUpdated": "2023-12-06T15:30:00.483Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:13:48.923Z"}, "title": "CVE Program Container", "references": [{"url": "https://confluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery-1319248914.html", "tags": ["x_transferred"]}, {"url": "https://jira.atlassian.com/browse/JSDSERVER-14925", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:assets_discovery_cloud:*:*:*:*:*:*:*:*", "matchCriteriaId": "B605B443-2604-4D2D-99C2-EF7D955B1886", "versionEndExcluding": "3.2.0", "versionStartIncluding": "1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:assets_discovery_data_center:*:*:*:*:*:*:*:*", "matchCriteriaId": "6EE9C216-E2F8-4BDB-A67B-095AA0B19613", "versionEndIncluding": "3.1.11", "versionStartIncluding": "1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:assets_discovery_data_center:*:*:*:*:*:*:*:*", "matchCriteriaId": "C95EF896-3AE4-400B-B4BD-61D909D91B5B", "versionEndExcluding": "6.2.0", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:assets_discovery_data_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "63079045-C71C-4D37-9B05-BD3705B90B37", "versionEndIncluding": "3.1.11", "versionStartIncluding": "1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:assets_discovery_data_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "329E8EB1-FEAC-4C29-B443-4AB31D5DBC95", "versionEndExcluding": "6.2.0", "versionStartIncluding": "6.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent."}, {"lang": "es", "value": "Esta vulnerabilidad, si se explota, permite a un atacante realizar RCE (ejecuci\u00f3n remota de c\u00f3digo) privilegiada en m\u00e1quinas con el agente Assets Discovery instalado. La vulnerabilidad existe entre la aplicaci\u00f3n Assets Discovery (anteriormente conocida como Insight Discovery) y el agente Assets Discovery."}], "id": "CVE-2023-22523", "lastModified": "2023-12-11T18:29:13.970", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@atlassian.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-12-06T05:15:10.087", "references": [{"source": "security@atlassian.com", "tags": ["Vendor Advisory"], "url": "https://confluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery-1319248914.html"}, {"source": "security@atlassian.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/JSDSERVER-14925"}], "sourceIdentifier": "security@atlassian.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}