CVE-2023-44384 - CVE House
Back to Database
Status published Medium CVE-2023-44384

Discourse-Jira could make SSRF attack by setting Jira URL to an arbitrary location

Vulnerability Description

Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administrator user can make an SSRF attack by setting the Jira URL to an arbitrary location and enabling the `discourse_jira_verbose_log` site setting. A moderator user could manipulate the request path to the Jira API, allowing them to perform arbitrary GET requests using the Jira API credentials, potentially with elevated permissions, used by the application.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-44384

Credits & Attribution

No credits recorded in the NVD database.

References

More from discourse

View All →
CVE-2025-69289
Discourse has insecure default configuration that allows non-admin moderators to takeover any non-staff account via email change
Medium 5.1
CVE-2025-69218
Discourse moderators can access admin-only reports exposing private upload URLs
High 7.1
CVE-2025-68934
Discourse Has Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint
Medium 6.5
CVE-2025-68933
Discourse non-admin moderators can exfiltrate private content via post ownership transfer
Medium 6.9
CVE-2025-68666
Discourse users archives leaked to users with moderation privileges
Medium 5.9

Affected Vendor

Affected Software

discourse-jira
Vulnerable Versions:
<= f11be4c

Timeline

Official Publish: October 6th, 2023
Last Modified: September 19th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Weaknesses (CWE)

CWE-691

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.