SB2019091709 - Multiple vulnerabilities in Atlassian Jira

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019091709

SB2019091709 - Multiple vulnerabilities in Atlassian Jira

Published: September 17, 2019

Security Bulletin ID SB2019091709
CSH Severity
Medium
Patch available
NO
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Cross-site request forgery (CVE-ID: CVE-2019-15002)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in the login form. A remote authenticated attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.


2) Missing authorization (CVE-ID: CVE-2019-14955)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Green


The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to missing permissions check in the "/rest/api/1.0/render" API endpoint. A remote attacker can differentiate between valid attachment names and invalid attachment names for any given issue.



Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References