Many resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, fr…

Published 8 y ago 2018-10-23 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.1

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.5%

percentile 74%

Public exploits

none known

Many resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allow remote attackers to attack users, in some cases be able to obtain a user's Cross-site request forgery (CSRF) token, via a open redirect vulnerability.

Exploit prediction (EPSS)

1.46% probability of exploitation in the next 30 days, higher than 74% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	6.1	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
NVD	2.0	5.8	`AV:N/AC:M/Au:N/C:P/I:P/A:N`

Affected products

Atlassian Jira

Classification

Weakness

CWE-601 URL Redirection to Untrusted Site

References

securityfocus.com /bid/105751 · vdb-entry, x_refsource_BID, x_transferred
jira.atlassian.com /browse/JRASERVER-68140 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2018-13402
NVD: CVE-2018-13402

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.