CVE-2019-8443 — Improper Authentication in Atlassian Jira

CWE-287 — Improper Authentication3 documents3 sources
Severity
8.1HIGHNVD
EPSS
0.6%
top 31.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Atlassian JiraAtlassian Jira Server
Timeline
PublishedMay 22
Latest updateMay 24

Description

The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers who have obtained access to administrator's session to access the ViewUpgrades administrative resource without needing to re-authenticate to pass "WebSudo" through an improper access control vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5atlassian/jiraunspecified — 7.13.4+4
▶NVDatlassian/jira< 7.13.4
▶NVDatlassian/jira_server8.0.0 — 8.0.4+1

🔴Vulnerability Details

2
GHSA
GHSA-h89j-v7mh-22q2: The ViewUpgrades resource in Jira before version 7↗2022-05-24
▶
CVEList
CVE-2019-8443: The ViewUpgrades resource in Jira before version 7↗2019-05-22
▶
CVE-2019-8443 — Improper Authentication in Atlassian | cvebase