CVE-2019-8443

The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers who have obtained access to administrator's session to access the ViewUpgrades administrative resource without needing to re-authenticate to pass "WebSudo" through an improper access control vulnerability.

CVSS v3 8.1 HIGH
CVSS v2.0 6.8 MEDIUM

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/108458	Broken Link
https://jira.atlassian.com/browse/JRASERVER-69240	Issue Tracking Vendor Advisory
http://www.securityfocus.com/bid/108458	Broken Link
https://jira.atlassian.com/browse/JRASERVER-69240	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:atlassian:jira::::::::
	cpe:2.3:a:atlassian:jira_server::::::::
	cpe:2.3:a:atlassian:jira_server::::::::

History

21 Nov 2024, 04:49

Type	Values Removed	Values Added
References	~~() http://www.securityfocus.com/bid/108458 - Broken Link~~	() http://www.securityfocus.com/bid/108458 - Broken Link
References	~~() https://jira.atlassian.com/browse/JRASERVER-69240 - Issue Tracking, Vendor Advisory~~	() https://jira.atlassian.com/browse/JRASERVER-69240 - Issue Tracking, Vendor Advisory

Information

Published : 2019-05-22 18:29

Updated : 2024-11-21 04:49

NVD link : CVE-2019-8443

Mitre link : CVE-2019-8443

CVE.ORG link : CVE-2019-8443

JSON object : View

Products Affected

atlassian

jira_server
jira

CWE

CWE-287

Improper Authentication

{"id": "CVE-2019-8443", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2019-05-22T18:29:02.100", "references": [{"url": "http://www.securityfocus.com/bid/108458", "tags": ["Broken Link"], "source": "security@atlassian.com"}, {"url": "https://jira.atlassian.com/browse/JRASERVER-69240", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@atlassian.com"}, {"url": "http://www.securityfocus.com/bid/108458", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://jira.atlassian.com/browse/JRASERVER-69240", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers who have obtained access to administrator's session to access the ViewUpgrades administrative resource without needing to re-authenticate to pass \"WebSudo\" through an improper access control vulnerability."}, {"lang": "es", "value": "El recurso ViewUpgrades en Jira antes de la versi\u00f3n 7.13.4, desde la versi\u00f3n 8.0.0 antes de la versi\u00f3n 8.0.4, y desde la versi\u00f3n 8.1.0 antes de la versi\u00f3n 8.1.1, permite a los atacantes remotos que han obtenido acceso a la sesi\u00f3n del administrador acceder al recurso administrativo de ViewUpgrades sin necesidad de volver a autenticarse para pasar \"WebSudo\" mediante una vulnerabilidad de Control de Acceso incorrecta."}], "lastModified": "2024-11-21T04:49:54.823", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5F53E99-E523-46BC-BB9C-2C1088D30E69", "versionEndExcluding": "7.13.4"}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D2468233-97B0-4673-A2EA-5787CFD56097", "versionEndExcluding": "8.0.4", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2806E160-A601-4276-A3F2-8F73DA3AE3E0", "versionEndExcluding": "8.1.1", "versionStartIncluding": "8.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@atlassian.com"}