Details
-
Public Security Vulnerability
-
Resolution: Fixed
-
Highest
-
Discovery 1.0-3.1.7, Discovery 3.1.8, Discovery 3.1.9, Discovery 3.1.10, Discovery 3.1.11
-
None
-
Severity 1 - Critical
-
9.8
-
CVE-2023-22523
-
RCE (Remote Code Execution)
Description
This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent. See “What You Need To Do” for detailed instructions.
Assets Discovery, which can be downloaded via Atlassian Marketplace, is a network scanning tool that can be used with or without an agent with Jira Service Management Cloud, Data Center or Server. It detects hardware and software that is connected to your local network and extracts detailed information about each asset. This data can then be imported into Assets in Jira Service Management to help you manage all of the devices and configuration items within your local network.
Â
Affected Versions
This vulnerability affects all versions prior to Assets Discovery 3.2.0-cloud / 6.2.0 Data Center and server Atlassian recommends patching to the latest version.
| Product  |
Component  |
Affected Versions  |
|---|---|---|
| Jira Service Management Cloud | Assets Discovery |
|
| Jira Service Management Data Center and Server | Assets Discovery |
|
Fixed Versions
There is no need to upgrade Jira Service Management product, only the Assets Discovery application and agents.
| Product  |
Component  |
Fixed Versions  |
|---|---|---|
| Jira Service Management Cloud | Assets Discovery |
|
| Jira Service Management Data Center and Server | Assets Discovery |
|
What You Need To Do
1. Uninstall Assets Discovery agents
2. Apply the Assets Discovery application patch
3. Re-install agents
Uninstalling the Assets Discovery agents is the quickest and safest way to mitigate risk. Once the agent(s) are uninstalled, you can apply the latest fixed version of the Assets Discovery application and re-install the Assets Discovery agents.
NOTE: Customers who do not currently use agents but may wish to in the future, must also apply the latest fixed version of the Assets Discovery application before installing agents.
What if I can’t immediately uninstall the agents?
Uninstalling the Assets Discovery agents is the most effective way to protect your data, and customers will need to follow all of the instructions above before using Assets Discovery agents again.
However, if you cannot immediately uninstall the Assets Discovery agents, customers may block the port used for communication with agents (the default port is 51337). This temporary mitigation is not a replacement for uninstalling the agents. Please see the FAQ for additional information.
Frequently Asked Questions
- More details can be found on the Frequently Asked Questions (FAQ) page.Â