dbcve.org
S NotifyApplication · Savignano

CVE-2023-50932

MEDIUM · 5.4 CVSS v3.1 Published 2024-01-09
Fix available
A fix is available. Upgrade to 4.0.2 or later.
See remediation →
61/100
Remediation priority · Elevated
Remotely reachable No privileges

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
An issue was discovered in savignano S/Notify before 4.0.2 for Confluence. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Confluence, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

This is a CSRF (Cross-Site Request Forgery) vulnerability in S/Notify for Confluence versions before 4.0.2. An attacker can craft a malicious link or website that, when visited by an authenticated administrator, tricks the browser into sending authenticated requests to modify S/Notify configuration settings, specifically disabling email encryption.

MitigationUpgrade to S/Notify version 4.0.2 or later which implements proper anti-CSRF tokens. Until then, administrators should avoid clicking untrusted links while logged into Confluence admin sessions.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
S NotifyApplication
Affected:< 4.0.2

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Locate S/Notify app version in Confluence
    Navigate to Confluence Settings > Apps > Manage apps (or Universal Plugin Manager). Find 'S/Notify for Confluence' in the list and note the Version column.
    Affected if Version shown is lower than 4.0.2 (e.g., 4.0.1, 4.0.0, 3.x.x)
  2. Confirm version number directly
    Click on the S/Notify app entry to expand details. Verify the exact version number displayed in the Version field.
    Affected if Version is 4.0.1 or earlier, or version shows as ' < 4.0.2' or similar pre-fix notation
  3. Check if email encryption is configured
    Navigate to S/Notify settings (typically under Confluence administration > S/Notify configuration). Look for email encryption or TLS/SSL settings.
    Affected if Email encryption settings exist and are currently enabled - the CSRF vulnerability allows attackers to disable these settings
  4. Verify Confluence admin session handling
    Review whether administrators browse other sites while logged into Confluence admin console. CSRF requires an authenticated admin session.
    Affected if Administrators may click untrusted links while logged into Confluence admin sessions

You are affected if S/Notify for Confluence is installed at any version before 4.0.2 and email encryption is configured, especially if admins browse untrusted sites in the same browser during active admin sessions.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 4.0.2 or later
Fixed in 4.0.2
Interim mitigation

Upgrade to S/Notify version 4.0.2 or later which implements proper anti-CSRF tokens. Until then, administrators should avoid clicking untrusted links while logged into Confluence admin sessions.

Recommended fix High confidence

4.0.2

  1. Download S/Notify version 4.0.2 or later from the Atlassian Marketplace or your vendor
  2. Upgrade the S/Notify app on your Confluence instance to version 4.0.2
  3. After upgrading, verify that email notification encryption settings are correctly configured in the S/Notify administration panel
  4. Confirm that CSRF protection is now properly enforced by testing that configuration changes require proper authentication tokens

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in S Notify Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing4.0 h
  • Review / QA2.0 h
18.0 hours of engineering $3,200
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,120.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2023-50932 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2023-50932 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data