Lucene search

Security-metrics-botJSWSERVER-20111

HistoryJun 23, 2019 - 10:48 p.m.

Denial of service in issue searching through Epic Name ordering - CVE-2019-11583

2019-06-2322:48:33

security-metrics-bot

jira.atlassian.com

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

46.4%

JSON

The issue searching component in Jira before version 8.1.0 allows remote attackers to
deny access to Jira service via denial of service vulnerability in issue search when ordering by “Epic Name”.

Affected configurations

Vulners

Node

atlassianjira_software_data_centerRange≤7.2.15

atlassianjira_software_data_centerRange≤8.0.0

atlassianjira_software_data_centerRange≤7.13.1

atlassianjira_software_data_centerRange≤7.6.11

atlassianjira_software_data_centerRange<8.1.0

atlassianjira_software_data_centerRange<7.13.4

CPENameOperatorVersion
jira software data centerle7.2.15
jira software data centerle8.0.0
jira software data centerle7.13.1
jira software data centerle7.6.11
jira software data centerlt8.1.0
jira software data centerlt7.13.4

Name	Operator	Version
jira software data center	le	7.2.15
jira software data center	le	8.0.0
jira software data center	le	7.13.1
jira software data center	le	7.6.11
jira software data center	lt	8.1.0
jira software data center	lt	7.13.4

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

46.4%

JSON

Related for JSWSERVER-20111