4.3

CVE-2019-20099

Exploit
The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to enumerate hosts and open ports on the internal network where Jira server is present.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Atlassian ≫ Jira Data Center Version >= 7.6.15 < 8.5.4
Atlassian ≫ Jira Data Center Version >= 8.5.5 < 8.6.2
Atlassian ≫ Jira Server Version >= 7.6.15 < 8.5.4
Atlassian ≫ Jira Server Version >= 8.5.5 < 8.6.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.74% 0.498
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://www.tenable.com/security/research/tra-2020-05
Third Party Advisory
Exploit
https://jira.atlassian.com/browse/JRASERVER-70606
Vendor Advisory
Issue Tracking