Jira Service ManagementApplication · Atlassian
CVE-2023-22501
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedAn authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain access to a Jira Service Management instance under certain circumstances_._ With write access to a User Directory and outgoing email enabled on a Jira Service Management instance, an attacker could gain access to signup tokens sent to users with accounts that have never been logged into. Access to these tokens can be obtained in two cases: * If the attacker is included on Jira issues or requests with these users, or * If the attacker is forwarded or otherwise gains access to emails containing a “View Request” link from these users. Bot accounts are particularly susceptible to this scenario. On instances with single sign-on, external customer accounts can be affected in projects where anyone can create their own account.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceAuthentication bypass in Jira Service Management Server/Data Center where an attacker with User Directory write access and outgoing email enabled can obtain signup tokens for users who have never logged in. Attackers can obtain these tokens either by being included on Jira issues with these users or by accessing forwarded emails containing 'View Request' links.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data
Jira Service ManagementApplication
>= 5.3.0, < 5.3.3>= 5.4.0, < 5.4.2= 5.5.0CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify Jira Service Management versionCheck the installed Jira Service Management version through the Atlassian administration console or by reviewing the application banner at the bottom of the login pageAffected if Version falls within >= 5.3.0, < 5.3.3; >= 5.4.0, < 5.4.2; or = 5.5.0
-
Verify outgoing email configurationNavigate to Jira administration > Mail > Outgoing Mail and check if outgoing email is enabled, or inspect the mail configuration XML/database recordsAffected if Outgoing email is enabled in the Jira Service Management configuration
-
Review User Directory write permissionsCheck Jira administration > User Directory > Directory Configuration to identify which users or groups have write access to User Directory settings, or review the directory_permissions table in the databaseAffected if Non-administrator users or service accounts have write access to User Directory configurations
-
Identify users with signup tokens who never logged inQuery the cwd_user and app_user tables for users where the active status and login history indicate no successful login, or check theu_ tables for pending signup tokensAffected if There are user accounts in the system that have never logged in and possess active signup tokens
Your environment is affected if you run an affected Jira Service Management version, have outgoing email enabled, and have users with User Directory write access who can view Jira issues containing never-logged-in users or their email correspondence.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped5.3.35.4.2
Restrict write access to User Directory configurations, disable outgoing email if not required, and implement additional validation for signup token usage to prevent unauthorized account impersonation.
5.3.3+ (5.3.x line), 5.4.2+ (5.4.x line), or 5.5.1+ (5.5.x line) - choose the appropriate minor version based on your current release
- Check your current Jira Service Management version in Administration > Applications > Jira Service Management > Settings
- Identify which affected version line you are on (5.3.x, 5.4.x, or 5.5.x)
- For version 5.3.x: Upgrade to version 5.3.3 or later
- For version 5.4.x: Upgrade to version 5.4.2 or later
- For version 5.5.x: Upgrade to version 5.5.1 or later (the next available patch release)
- After upgrade, verify the instance is operational and test user authentication flows
- Review audit logs for any suspicious activity around user signup tokens
Generated from the published advisory — verify against the referenced sources before acting.
Fix this in Jira Service Management
Scoped from the published advisory
- Consultation6.0 h
- Implementation12.0 h
- Testing8.0 h
- Review / QA4.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $8,448.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2023-22501 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2023-22501 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data