CVE-2023-30285

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-31 · updated 2026-07-09

Description

An issue in Deviniti Issue Sync Synchronization v3.5.2 for Jira allows attackers to obtain the login credentials of a user via a crafted request sent to /rest/synchronizer/1.0/technicalUser.

Affected products

Deviniti Issue Sync: before 3.5.2 — fixed in 3.5.2

How to fix

Upgrade to a fixed version: Deviniti Issue Sync 3.5.2. Check the vendor advisory for mitigations.

References

https://github.com/D23K4N/CVE/blob/main/CVE-2023-30285.md
https://github.com/D23K4N/CVE/blob/main/CVE-2023-30285.md

Get alerted when CVE-2023-30285 or the next vulnerability affects your stack