CVE-2024-23734 - Vulnerability Details - OpenCVE

Cross Site Request Forgery vulnerability in in the upload functionality of the User Profile pages in savignano S/Notify before 2.0.1 for Bitbucket allow attackers to replace S/MIME certificate or PGP keys for arbitrary users via crafted link.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00169.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Savignano	S-notify

Configuration 1 [-]

cpe:2.3:a:savignano:s-notify:*:*:*:*:*:bitbucket:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://help.savignano.net/snotify-email-encryption/sa-2023-11-28
https://help.savignano.net/snotify-email-encryption/security-advisories

History

Tue, 17 Jun 2025 18:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Savignano Savignano s-notify
CPEs		cpe:2.3:a:savignano:s-notify::::::bitbucket::*
Vendors & Products		Savignano Savignano s-notify

Thu, 31 Oct 2024 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-352
Metrics		cvssV3_1 `{'score': 5.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-04-10T00:00:00

Updated: 2024-10-31T15:16:58.130Z

Reserved: 2024-01-21T00:00:00

Link: CVE-2024-23734

Vulnrichment

Updated: 2024-08-01T23:13:07.219Z

NVD

Status : Analyzed

Published: 2024-04-10T16:15:09.890

Modified: 2025-06-17T17:53:29.890

Link: CVE-2024-23734

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-23734", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-10-31T15:16:58.130Z", "dateReserved": "2024-01-21T00:00:00", "datePublished": "2024-04-10T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-04-10T15:20:47.451327"}, "descriptions": [{"lang": "en", "value": "Cross Site Request Forgery vulnerability in in the upload functionality of the User Profile pages in savignano S/Notify before 2.0.1 for Bitbucket allow attackers to replace S/MIME certificate or PGP keys for arbitrary users via crafted link."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://help.savignano.net/snotify-email-encryption/sa-2023-11-28"}, {"url": "https://help.savignano.net/snotify-email-encryption/security-advisories"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-352", "lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-07-31T17:55:42.652223Z", "id": "CVE-2024-23734", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-31T15:16:58.130Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:13:07.219Z"}, "title": "CVE Program Container", "references": [{"url": "https://help.savignano.net/snotify-email-encryption/sa-2023-11-28", "tags": ["x_transferred"]}, {"url": "https://help.savignano.net/snotify-email-encryption/security-advisories", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://help.savignano.net/snotify-email-encryption/sa-2023-11-28", "tags": ["x_transferred"]}, {"url": "https://help.savignano.net/snotify-email-encryption/security-advisories", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:13:07.219Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-23734", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-31T17:55:42.652223Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-31T17:55:46.590Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://help.savignano.net/snotify-email-encryption/sa-2023-11-28"}, {"url": "https://help.savignano.net/snotify-email-encryption/security-advisories"}], "descriptions": [{"lang": "en", "value": "Cross Site Request Forgery vulnerability in in the upload functionality of the User Profile pages in savignano S/Notify before 2.0.1 for Bitbucket allow attackers to replace S/MIME certificate or PGP keys for arbitrary users via crafted link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-04-10T15:20:47.451327"}}}, "cveMetadata": {"cveId": "CVE-2024-23734", "state": "PUBLISHED", "dateUpdated": "2024-10-31T15:16:58.130Z", "dateReserved": "2024-01-21T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-04-10T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:savignano:s-notify:*:*:*:*:*:bitbucket:*:*", "matchCriteriaId": "9A8B8F5B-9474-442E-8F4B-1A9187186CB6", "versionEndExcluding": "2.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross Site Request Forgery vulnerability in in the upload functionality of the User Profile pages in savignano S/Notify before 2.0.1 for Bitbucket allow attackers to replace S/MIME certificate or PGP keys for arbitrary users via crafted link."}, {"lang": "es", "value": "Vulnerabilidad de Cross Site Request Forgery en la funcionalidad de carga de las p\u00e1ginas de perfil de usuario en savignano S/Notify anterior a 2.0.1 para Bitbucket permite a los atacantes reemplazar el certificado S/MIME o las claves PGP para usuarios arbitrarios a trav\u00e9s de un enlace manipulado espec\u00edficamente para ello."}], "id": "CVE-2024-23734", "lastModified": "2025-06-17T17:53:29.890", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 4.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-04-10T16:15:09.890", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://help.savignano.net/snotify-email-encryption/sa-2023-11-28"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://help.savignano.net/snotify-email-encryption/security-advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://help.savignano.net/snotify-email-encryption/sa-2023-11-28"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://help.savignano.net/snotify-email-encryption/security-advisories"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}