SB2019121831 - Multiple vulnerabilities in Atlassian JIRA

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019121831

SB2019121831 - Multiple vulnerabilities in Atlassian JIRA

Published: December 18, 2019 Updated: July 17, 2020

Security Bulletin ID SB2019121831
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Open redirect (CVE-ID: CVE-2019-20901)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect in the os_destination parameter.


2) Missing Authorization (CVE-ID: CVE-2019-15013)

The vulnerability allows a remote authenticated user to manipulate data.

The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8.5.2 allows authenticated remote attackers who do not have project administration access to remove a configured issue status from a project via a missing authorisation check.


Remediation

Install update from vendor's website.

References