CVE-2019-8443

The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers who have obtained access to administrator's session to access the ViewUpgrades administrative resource without needing to re-authenticate to pass "WebSudo" through an improper access control vulnerability.

Score

CVSS 3.1 8.1 High

Status

Modified - security@atlassian.com

Published

2019-05-22

Last modified

2024-09-17

Weaknesses

CWE-284, CWE-287

Affected products

• Jira (Atlassian)
• Jira Server (Atlassian)

References

• http://www.securityfocus.com/bid/108458
• https://jira.atlassian.com/browse/JRASERVER-69240