CVE-2019-15002

An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. The login form doesn’t require a CSRF token. As a result, an attacker can log a user into the system under an unexpected account.

Score

CVSS 3.1 4.3 Medium

Status

Analyzed - security@atlassian.com

Published

2025-02-11

Last modified

2025-03-13

Weaknesses

CWE-352

Affected products

• Jira Data Center (Atlassian)
• Jira Server (Atlassian)

References

• https://jira.atlassian.com/browse/JRASERVER-67979