CVE-2019-20901 — Open Redirect in Atlassian Jira Server

CWE-601 — Open Redirect3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.3%
top 49.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Atlassian Jira ServerAtlassian Jira
Timeline
PublishedJul 13
Latest updateMay 24

Description

The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect in the os_destination parameter.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶NVDatlassian/jira< 8.5.2
▶CVEListV5atlassian/jira_serverunspecified — 8.5.2+2

🔴Vulnerability Details

2
GHSA
GHSA-24mj-x7vx-3j5j: The login↗2022-05-24
▶
CVEList
CVE-2019-20901: The login↗2020-07-13
▶
CVE-2019-20901 — Open Redirect in Atlassian Jira Server | cvebase