[JRASERVER-70606] CSRF in VerifyPopServerConnection!add.jspa - CVE-2019-20099 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Medium (View bug fix roadmap)
Fix Version/s: 8.7.0, 8.5.4
Affects Version/s: 8.2.4, 7.6.15
Component/s: System Administration - Others
Labels:

Fixed in Long Term Support Release/s:

Download 8.5
Introduced in Version:
7.06
Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to enumerate hosts and open ports on the internal network where Jira server is present.

No work has yet been logged on this issue.

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Affected customers:: 0 This affects my team

Watchers:: 10 Start watching this issue

Created:: 05/Feb/2020 4:03 PM

Updated:: 20/Aug/2020 11:59 PM

Resolved:: 05/Feb/2020 4:48 PM

Details

Description

Attachments

Forms

Activity

[JRASERVER-70606] CSRF in VerifyPopServerConnection!add.jspa - CVE-2019-20099

People

Dates