Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-70605

CSRF in VerifySmtpServerConnection!add.jspa - CVE-2019-20098

XMLWordPrintable

      The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to enumerate hosts and open ports on the internal network where Jira server is present.

            [JRASERVER-70605] CSRF in VerifySmtpServerConnection!add.jspa - CVE-2019-20098

            APACIT Chubb added a comment -

            Has this been ported back to Enterprise Release 7.13 ?

            APACIT Chubb added a comment - Has this been ported back to Enterprise Release 7.13 ?

            Robert Conrad added a comment -

            @Michael Aglas: Please check End of Life policies for Enterprise Releases.

            Robert Conrad added a comment - @Michael Aglas: Please check End of Life policies for Enterprise Releases .

            Michael Aglas added a comment -

            @robert.conrad who is still using Jira 7x? there are more CVEs solved meanwhile, so you should really think about upgrading to latest version

            due to the success of Jira it's meanwhile in the focus for remote attackers, you should not underrate this fact

            Michael Aglas added a comment - @robert.conrad who is still using Jira 7x? there are more CVEs solved meanwhile, so you should really think about upgrading to latest version due to the success of Jira it's meanwhile in the focus for remote attackers, you should not underrate this fact

            Robert Conrad added a comment -

            According to this ticket the Introduced in Version is 7.6.

            When can we expect a fix for the previous (and still valid) Enterprise Release 7.13?

            Robert Conrad added a comment - According to this ticket the Introduced in Version is 7.6. When can we expect a fix for the previous (and still valid) Enterprise Release 7.13?

            Anurag Jalan added a comment -

            Any interim solution for this?

            Anurag Jalan added a comment - Any interim solution for this?

            Babiel GmbH added a comment -

            Hi there,

            since this bug is more than a month old and still no release of version 8.5.4, when will it be available?

            Regards, Christian

            Babiel GmbH added a comment - Hi there, since this bug is more than a month old and still no release of version 8.5.4, when will it be available? Regards, Christian

            Mateusz Marzęcki added a comment -

            Dimitri, Adrian, Stefan, everyone, 

             

            Thanks for your feedback, I am glad to announce that the fix has been backported to the 8.5.4 and 8.6.2 and will be available soon.

             

            Thanks, 

            Mateusz

            Jira Server

            Mateusz Marzęcki added a comment - Dimitri, Adrian, Stefan, everyone,    Thanks for your feedback, I am glad to announce that the fix has been backported to the 8.5.4 and 8.6.2 and will be available soon.   Thanks,  Mateusz Jira Server

            Deleted Account (Inactive) added a comment -

            Same question from my side!

            Deleted Account (Inactive) added a comment - Same question from my side!

            Dimitri added a comment -

            Will this, JRASERVER-70606, and JRASERVER-70607 be ported to the 8.5.x enterprise release as well or just 8.7.x?

            Dimitri added a comment - Will this, JRASERVER-70606 , and JRASERVER-70607 be ported to the 8.5.x enterprise release as well or just 8.7.x?

            Security Metrics Bot added a comment -

            This is an independent assessment and you should evaluate its applicability to your own IT environment.
            CVSS v3 score: 4.7 => Medium severity

            Exploitability Metrics

            Attack Vector Network
            Attack Complexity Low
            Privileges Required None
            User Interaction Required

            Scope Metric

            Scope Changed

            Impact Metrics

            Confidentiality Low
            Integrity None
            Availability None

            https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

            Security Metrics Bot added a comment - This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 4.7 => Medium severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required None User Interaction Required Scope Metric Scope Changed Impact Metrics Confidentiality Low Integrity None Availability None https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

              Unassigned Unassigned
              security-metrics-bot Security Metrics Bot
              Affected customers:
              0 This affects my team
              Watchers:
              14 Start watching this issue

                Created:
                Updated:
                Resolved: