Atlassian Jira 7.13.0 < 7.13.6 Multiple Vulnerabilities

2023-03-1400:00:00

www.tenable.com

atlassian jira

vulnerabilities

remote attackers

garbage collection

modify settings

create resolutions

phishing attack

csrf vulnerability

open redirect

EPSS

0.001

Percentile

46.7%

JSON

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is version 7.13.0 prior to 7.13.6 or 8.0.0 prior to 8.3.2. It is, therefore, affected by multiple vulnerabilities:

A issue which permits remote attackers to trigger garbage collection via a Cross-site request forgery (CSRF) vulnerability (CVE-2019-11588).
A issue which permits remote attackers to modify various settings via a Cross-site request forgery (CSRF) vulnerability (CVE-2019-11587).
A issue which permits remote attackers to create new resolutions via a Cross-site request forgery (CSRF) vulnerability (CVE-2019-11586).
A vulnerability which permits remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect (CVE-2019-11585).

Note that the scanner has not tested for these issues but has instead relied only on the application’s self-reported version number.