• Type: Bug
• Resolution: Fixed
• Priority: Low (View bug fix roadmap)
• Fix Version/s: 7.13.1, 7.12.3, 8.0.0
• Affects Version/s: 7.3.7, 7.9.2
• Component/s: Front-end API
• Labels:

  • advisory
  • advisory-released
  • architectural-flaw
  • cvss-medium
  • patch-management
  • security

[JRASERVER-69040] The version of moment.js used in Jira was vulnerable to a regular expression denial of service

Collapse comment: Security Metrics Bot added a comment - 21/Mar/2019 12:46 AM

Security Metrics Bot added a comment - 21/Mar/2019 12:46 AM

This is an independent assessment and you should evaluate its applicability to your own IT environment.
CVSS v3 score: 4.3 => Medium severity

Exploitability Metrics

Attack Vector	Network
Attack Complexity	Low
Privileges Required	Low
User Interaction	None

Scope Metric

Scope	Unchanged

Impact Metrics

Confidentiality	None
Integrity	None
Availability	Low

https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Expand comment: Security Metrics Bot added a comment - 21/Mar/2019 12:46 AM

Security Metrics Bot added a comment - 21/Mar/2019 12:46 AM This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 4.3 => Medium severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction None Scope Metric Scope Unchanged Impact Metrics Confidentiality None Integrity None Availability Low https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L