TI-2019-14513 Aliases CVE-2019-20105 GHSA-hhrj-8h23-4fr8

Missing authentication in Atlassian Application Links

LOW 25CWE-306Published 2020-03-17 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-306.

Summary

The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.1, and from version 7.1.0 before version 7.1.3 allows remote attackers who have obtained access to administrator's session to access the EditApplinkServlet resource without needing to re-authenticate to pass "WebSudo" in products that support "WebSudo" through an improper access control vulnerability.

Why it matters now

EPSS 0.01487 74th percentileScored 2026-11-07

Fix Fixed Application Links (Atlassian): 5.4.20, 6.0.12, 7.0.1 +1Jira Server and Data Center (Atlassian): 7.13.12, 8.5.4, 8.6.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Atlassian	Application Links	before 5.4.20; 6.0.0 and later; before 6.0.12; 7.0.0 and later; before 7.0.1; 7.1.0 and later; before 7.1.3	5.4.20, 6.0.12, 7.0.1, 7.1.3	Patch available	CNA
Atlassian	Jira Server and Data Center	7.13.8 and later; before 7.13.12; 8.4.2 and later; before 8.5.4; 8.6.0 and later; before 8.6.1	7.13.12, 8.5.4, 8.6.1	Patch available	CNA

Application Links VendorAtlassian Affected before 5.4.20; 6.0.0 and later; before 6.0.12; 7.0.0 and later; before 7.0.1; 7.1.0 and later; before 7.1.3 Fixed in 5.4.20, 6.0.12, 7.0.1, 7.1.3 Patch available CNA
Jira Server and Data Center VendorAtlassian Affected 7.13.8 and later; before 7.13.12; 8.4.2 and later; before 8.5.4; 8.6.0 and later; before 8.6.1 Fixed in 7.13.12, 8.5.4, 8.6.1 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:atlassian:application_links::::::::	up to 5.4.20; 6.0.0 – 6.0.12; 6.1.0 to before 6.1.2; 7.1.0 to before 7.1.3	Vulnerable	Atlassian
cpe:2.3:a:atlassian:application_links:7.0.0:::::::*	7.0.0	Vulnerable	Atlassian

cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:* Versions up to 5.4.20; 6.0.0 – 6.0.12; 6.1.0 to before 6.1.2; 7.1.0 to before 7.1.3 Vulnerable ·Atlassian
cpe:2.3:a:atlassian:application_links:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Atlassian

Remediation

Fix · CNA Application Links (Atlassian) Fixed in 5.4.20, 6.0.12, 7.0.1, 7.1.3
Fix · CNA Jira Server and Data Center (Atlassian) Fixed in 7.13.12, 8.5.4, 8.6.1

Timeline

2026-10-02 Threatist record created from CVE-2019-20105
2026-10-03 Alias added: GHSA-hhrj-8h23-4fr8

References

Advisory 2

TI-2017-13318 XML external entity injection in Atlassian Application Links CVSS 3.0HIGH 8.7
TI-2017-13304 Server-side request forgery in Atlassian Application Links CVSS 3.0HIGH 7.2
TI-2018-14346 Cross-site scripting in Atlassian Application Links CVSS 3.1MEDIUM 5.4
TI-2017-12406 Cross-site scripting in Atlassian Application Links CVSS 3.0MEDIUM 6.1
TI-2018-03784 Cross-site scripting in Atlassian Application Links CVSS 3.0MEDIUM 4.8
TI-2019-11197 Incorrect default permissions in Atlassian Application Links CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences