PT-2019-12976 · Bobronix · Jeditor For Jira

Published 2019-06-21 · Updated 2019-06-25 · CVE-2019-12836

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bobronix JEditor for Jira versions prior to 3.0.6

Description The issue allows an attacker to add a URL/Link to an existing issue that can cause forgery of a request to an out-of-origin domain. This may lead to a forged request being invoked in the context of an authenticated user, resulting in the stealing of session tokens and potential account takeover.

Recommendations For versions prior to 3.0.6, update to version 3.0.6 or later to resolve the issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-12836

Affected Products

Jeditor For Jira

References · 5

• 🔥 https://github.com/9lyph/CVE-2019-12836/blob/master/README.md · Exploit
• 🔥 https://github.com/9lyph/CVE-2019-12836 · Exploit
• https://osv.dev/vulnerability/CVE-2019-12836 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12836 · Security Note
• https://jeditor.zendesk.com/hc/en-us/articles/360029430751-JEditor-3-0-6-release-notes · Note