CVE-2019-8447 — Cross-Site Request Forgery in Atlassian Jira

CWE-352 — Cross-Site Request Forgery3 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.1%
top 71.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Atlassian JiraAtlassian Jira Server
Timeline
PublishedAug 23
Latest updateMay 24

Description

The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site request forgery (CSRF) vulnerability.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5atlassian/jiraunspecified — 8.3.2
▶NVDatlassian/jira_server7.13.0 — 8.3.2

🔴Vulnerability Details

2
GHSA
GHSA-v6j9-3grc-c9r7: The ServiceExecutor resource in Jira before version 8↗2022-05-24
▶
CVEList
CVE-2019-8447: The ServiceExecutor resource in Jira before version 8↗2019-08-23
▶
CVE-2019-8447 — Cross-Site Request Forgery in Atlassian | cvebase