Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveAtlassianCVE-2018-13404
HistoryFeb 13, 2019 - 6:29 p.m.

CVE-2018-13404

2019-02-1318:29:00
CWE-918
atlassian
web.nvd.nist.gov
45
cve
2018
13404
ssrf vulnerability
atlassian jira
nvd
security loophole

CVSS2

4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

AI Score

4

Confidence

High

EPSS

0.001

Percentile

31.8%

JSON

The VerifyPopServerConnection resource in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and from version 7.13.0 before version 7.13.1 allows remote attackers who have administrator rights to determine the existence of internal hosts & open ports and in some cases obtain service information from internal network resources via a Server Side Request Forgery (SSRF) vulnerability.

Affected configurations

Nvd
Node
atlassianjiraRange<7.6.10
OR
atlassianjira_serverRange7.7.0–7.7.5
OR
atlassianjira_serverRange7.8.0–7.8.4
OR
atlassianjira_serverRange7.9.0–7.9.2
OR
atlassianjira_serverRange7.10.0–7.10.2
OR
atlassianjira_serverRange7.11.0–7.11.3
OR
atlassianjira_serverRange7.12.0–7.12.3
OR
atlassianjira_serverRange7.13.0–7.13.1
VendorProductVersionCPE
atlassianjira*cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
atlassianjira_server*cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*

CNA Affected

[
  {
    "product": "Jira",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "7.6.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.7.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.7.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.8.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.8.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.9.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.9.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.10.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.10.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.11.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.11.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.12.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.12.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.13.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.13.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Related

prion 1
atlassian 2
nvd 1
nessus 10
cvelist 1
prion
prion
Server side request forgery (ssrf)
2019-02-13 18:29:00
atlassian
atlassian
The VerifyPopServerConnection resource was vulnerable to SSRF - CVE-2018-13404
2018-12-03 02:58:19
The VerifyPopServerConnection resource was vulnerable to SSRF - CVE-2018-13404
2018-12-03 02:58:19
nvd
nvd
CVE-2018-13404
2019-02-13 18:29:00
nessus
nessus
Atlassian JIRA Server-Side Request Forgery (SSRF) Vulnerability (JRASERVER-68527)
2019-05-10 00:00:00
Atlassian Jira 7.13.x < 7.13.1 Multiple Vulnerabilities
2023-03-14 00:00:00
Atlassian Jira 7.8.x < 7.8.5 Multiple Vulnerabilities
2023-03-14 00:00:00
cvelist
cvelist
CVE-2018-13404
2019-02-13 18:00:00

CVSS2

4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

AI Score

4

Confidence

High

EPSS

0.001

Percentile

31.8%

JSON
Related for CVE-2018-13404
prion1atlassian2nvd1nessus10cvelist1