Multiple vulnerabilities in Atlassian JIRA



Published: 2020-06-23 | Updated: 2020-08-08
Risk High
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2019-20898
CVE-2019-20418
CVE-2019-20409
CWE-ID CWE-200
CWE-20
CWE-74
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		Jira Software
Client/Desktop applications / Other client software

Vendor Atlassian

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU34156

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-20898

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticated in the Global permissions screen. The affected versions are before version 8.8.0.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Jira Software: 8.0.0 - 8.7.1

External links

http://jira.atlassian.com/browse/JRASERVER-70942


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU34175

Risk: Medium

CVSSv3.1: 5.7 [AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-20418

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can prevent users from accessing the instance via an Application Denial of Service vulnerability in the /rendering/wiki endpoint.

Mitigation

Update to version 8.8.0.

Vulnerable software versions

Jira Software: 8.0.0 - 8.7.1

External links

http://jira.atlassian.com/browse/JRASERVER-70943


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper Neutralization of Special Elements in Output Used by a Downstream Component

EUVDB-ID: #VU34202

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-20409

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Jira Software: 8.0.0 - 8.7.1

External links

http://jira.atlassian.com/browse/JRASERVER-70944


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###