CVE-2019-11585 — Open Redirect in Atlassian Jira

CWE-601 — Open Redirect3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.2%
top 63.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Atlassian JiraAtlassian Jira Server
Timeline
PublishedAug 23
Latest updateMay 24

Description

The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5atlassian/jiraunspecified — 7.13.6+4
▶NVDatlassian/jira< 7.13.6
▶NVDatlassian/jira_server8.0.0 — 8.2.3+1

🔴Vulnerability Details

2
GHSA
GHSA-qghg-mq98-mjr4: The startup↗2022-05-24
▶
CVEList
CVE-2019-11585: The startup↗2019-08-23
▶
CVE-2019-11585 — Open Redirect in Atlassian Jira | cvebase