Lucene search

AtlassianCVE-2019-14998

HistorySep 11, 2019 - 2:15 p.m.

CVE-2019-14998

2019-09-1114:15:11

CWE-352

atlassian

web.nvd.nist.gov

cve-2019-14998

webwork action

csrf protection

jira

bypass

cookie tossing

subdomain

security vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

47.4%

JSON

The Webwork action Cross-Site Request Forgery (CSRF) protection implementation in Jira before version 8.4.0 allows remote attackers to bypass its protection via “cookie tossing” a CSRF cookie from a subdomain of a Jira instance.

Affected configurations

Nvd

Node

atlassianjira_serverRange7.4.0–8.4.0

VendorProductVersionCPE
atlassianjira_server*cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
atlassian	jira_server	*	cpe:2.3:a:atlassian:jira_server::::::::

CNA Affected

[
  {
    "product": "Jira",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "8.4.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

jira.atlassian.com/browse/JRASERVER-69791

www.talosintelligence.com/vulnerability_reports/TALOS-2019-0835

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

47.4%

JSON

Related for CVE-2019-14998