CVE-2019-20105
The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12,…
Published 6 y ago · modified 4 mo ago · JSON
Summary
The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.1, and from version 7.1.0 before version 7.1.3 allows remote attackers who have obtained access to administrator's session to access the EditApplinkServlet resource without needing to re-authenticate to pass "WebSudo" in products that support "WebSudo" through an improper access control vulnerability.
Exploit prediction (EPSS)
1.49% probability of exploitation in the next 30 days, higher than 74% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N |
Affected products
- Atlassian Application Links
- Atlassian Jira Server and Data Center
Classification
- Weakness
- CWE-306 Missing Authentication for Critical Functionality
References
- ecosystem.atlassian.net /browse/APL-1391 · x_refsource_MISC, x_transferred
- jira.atlassian.com /browse/JRASERVER-70526 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2019-20105
- NVD: CVE-2019-20105
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.