Jira Data Center
CVE-2019-15002
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. The login form doesn’t require a CSRF token. As a result, an attacker can log a user into the system under an unexpected account.
AnalysisAI
An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. The login form doesn’t require a CSRF token. As a result, an attacker can log a user into the system under an unexpected account. Affected products include: Atlassian Jira Data Center, Atlassian Jira Server.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.
More in Jira Data Center
View allThis High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and
A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path tr
Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Fil
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached c
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Infor
The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from 8
This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and
This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has
Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today