Atlassian has released patches to resolve a critical vulnerability in the Jira Service Management Server and Data Center system that could be exploited by an attacker to impersonate another user.
The vulnerability has been named CVE-2023-22501. In this situation, A malicious actor can impersonate a user and obtain the login tokens of those users who are not yet logged in.
Such tokens, according to Atlassian, can be obtained in two scenarios: the attacker is included in one of the requests handled in Jira or the attacker gains access to the emails. This vulnerability would affect the versions 5.3 and 5.5.
For its part, The manufacturer has already published patches in the applications to fix this vulnerability, What, Of course, It is recommended to apply.
Fountain: The Hacker News