Multiple vulnerabilities in Atlassian JIRA

Published: 2020-02-06 | Updated: 2020-07-17

Risk	Medium
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2019-20400 CVE-2019-20401 CVE-2019-20405
CWE-ID	CWE-426 CWE-352
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Jira Software Client/Desktop applications / Other client software
Vendor	Atlassian

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Untrusted search path

EUVDB-ID: #VU30379

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-20400

CWE-ID: CWE-426 - Untrusted Search Path

Exploit availability: No

Description

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global path environmental variable can inject code into via a DLL hijacking vulnerability.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Jira Software: 8.5.3 - 8.5.5

External links

http://jira.atlassian.com/browse/JRASERVER-70407

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Cross-site request forgery

EUVDB-ID: #VU30380

Risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-20401

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.