[JRASERVER-69782] The ViewLogging class exposed various resources that were vulnerable to CSRF - CVE-2019-11587 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: High (View bug fix roadmap)
Fix Version/s: 8.2.3, 8.4.0, 7.13.6, 8.3.2
Affects Version/s: 7.13.0, 8.1.1
Component/s: System Administration - Audit Logs
Labels:
- CVE-2019-11587
- advisory
- advisory-released
- bugbounty
- csrf
- cvss-medium
- raid
- security
- warranty
- xsrf

Fixed in Long Term Support Release/s:

Download 7.13
Introduced in Version:
7.13
Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allow remote attackers to modify various settings via Cross-site request forgery (CSRF).

mentioned in: Page Loading...

No work has yet been logged on this issue.

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Affected customers:: 0 This affects my team

Watchers:: 1 Start watching this issue

Created:: 09/Aug/2019 3:48 AM

Updated:: 22/Jun/2020 8:27 AM

Resolved:: 09/Aug/2019 3:48 AM

Details

Description

Attachments

Issue Links

Forms

Activity

[JRASERVER-69782] The ViewLogging class exposed various resources that were vulnerable to CSRF - CVE-2019-11587

People

Dates