Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: Atlassian Jira 8.4.0 Clear all filters
TI-2019-06067 CVE-2019-8451 · GHSA-hp98-w9mh-2g6q

Server-side request forgery in Atlassian Jira

Priority HIGH 73

The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a l…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.94453 Published 2019-09-11 Fixed in 8.4.0 CWE-918
TI-2019-06065 CVE-2019-8449 · GHSA-8wr9-r69x-g268

Missing authentication in Atlassian Jira

Priority HIGH 66

The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.85739 Published 2019-09-11 Fixed in 8.4.0 CWE-306
TI-2019-11184 CVE-2019-14998 · GHSA-pxw3-82pf-w6pr

Cross-site request forgery in Atlassian Jira

Priority LOW 31

The Webwork action Cross-Site Request Forgery (CSRF) protection implementation in Jira before version 8.4.0 allows remote attackers to bypass its protection via "cookie tossing" a CSRF cookie from a subdomain of a Jira i…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01175 Published 2019-09-11 Fixed in 8.4.0 CWE-352
TI-2019-11183 CVE-2019-14997 · GHSA-3cvq-p878-rmp8

The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers…

Priority LOW 22

The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers to learn details about other users, including their username, via an information expose through caching vulnerability when Jira is…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.01166 Published 2019-09-11 Fixed in 8.4.0 CWE-524
TI-2019-11181 CVE-2019-14995 · GHSA-qr6q-3xcr-gfvw

Incorrect authorization in Atlassian Jira

Priority LOW 30

The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is valid via a missing permissions check.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03012 Published 2019-09-11 Fixed in 8.4.0 CWE-863