PT-2020-10418 · Atlassian · Jira

Published 2020-02-06 · Updated 2022-03-25 · CVE-2019-20401

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jira versions prior to 8.5.2

Description The issue concerns a Cross-site request forgery (CSRF) vulnerability that allows remote attackers to configure a Jira instance that has not yet finished being installed. This can be done by exploiting various installation setup resources in Jira.

Recommendations For versions prior to 8.5.2, update to version 8.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the installation setup resources to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-20401

Affected Products

Jira

References · 3

• https://jira.atlassian.com/browse/JRASERVER-70406 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20401 · Security Note
• https://osv.dev/vulnerability/CVE-2019-20401 · Vendor Advisory