Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-70570

JMX monitoring flag in Jira was vulnerable to XSRF/CSRF - CVE-2019-20405

XMLWordPrintable

      The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a Cross-site request forgery (CSRF) vulnerability.

            [JRASERVER-70570] JMX monitoring flag in Jira was vulnerable to XSRF/CSRF - CVE-2019-20405

            Sherryl Radbil added a comment -

            So it turns out that the vulnerability we are discussing is NOT Low but rather medium.
            Please see the official page:
            https://nvd.nist.gov/vuln/detail/CVE-2019-20405
            You will see this is not 3.4 Low, but 4.3 Medium.

            Please re-evaluate your stance to abandon people who are on the LTS and put the fix in there ASAP.

            Sherryl Radbil added a comment - So it turns out that the vulnerability we are discussing is NOT Low but rather medium. Please see the official page: https://nvd.nist.gov/vuln/detail/CVE-2019-20405 You will see this is not 3.4 Low, but 4.3 Medium. Please re-evaluate your stance to abandon people who are on the LTS and put the fix in there ASAP.

            Sherryl Radbil added a comment -

            According to Security Bug Fix Policy

            Low severity bugs (CVSS v2 score < 3, CVSS v3 score < 4) to be fixed in product within 25 weeks of being reported

            It has been more than 25 weeks since this ticket was opened.
            When will there be a fix to the 8.5 Long Term Support release?

            Sherryl Radbil added a comment - According to Security Bug Fix Policy Low severity bugs (CVSS v2 score < 3, CVSS v3 score < 4) to be fixed in product within 25 weeks of being reported It has been more than 25 weeks since this ticket was opened. When will there be a fix to the 8.5 Long Term Support release?

            Andrew Zimmerman added a comment -

            Does a version of Jira Server 8.5.x remediate this risk?

            Andrew Zimmerman added a comment - Does a version of Jira Server 8.5.x remediate this risk?

            Deleted Account (Inactive) added a comment -

            I see now that the enterprise releases might only receive fixes for critical severity issues. 

            Deleted Account (Inactive) added a comment - I see now that the enterprise releases might only receive fixes for critical severity issues. 

            Deleted Account (Inactive) added a comment -

            Why is this closed without a fix for enterprise version 7.13.x?

            Deleted Account (Inactive) added a comment - Why is this closed without a fix for enterprise version 7.13.x?

            Thorsten Stöhr added a comment -

            Will you provide a fix for Enterprise release 8.5?  

            Thx

            Thorsten Stöhr added a comment - Will you provide a fix for Enterprise release 8.5?   Thx

            Security Metrics Bot added a comment -

            This is an independent assessment and you should evaluate its applicability to your own IT environment.
            CVSS v3 score: 3.4 => Low severity

            Exploitability Metrics

            Attack Vector Network
            Attack Complexity High
            Privileges Required None
            User Interaction Required

            Scope Metric

            Scope Changed

            Impact Metrics

            Confidentiality None
            Integrity Low
            Availability None

            https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N

            Security Metrics Bot added a comment - This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 3.4 => Low severity Exploitability Metrics Attack Vector Network Attack Complexity High Privileges Required None User Interaction Required Scope Metric Scope Changed Impact Metrics Confidentiality None Integrity Low Availability None https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N

              Unassigned Unassigned
              security-metrics-bot Security Metrics Bot
              Affected customers:
              0 This affects my team
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: