SB2018110609 - Multiple vulnerabilities in Atlassian JIRA
Published: November 6, 2018
Security Bulletin ID
SB2018110609
Severity
Low
Patch available
YES
Number of vulnerabilities
3
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Improper access control (CVE-ID: CVE-2018-13400)
The vulnerability allows a remote attacker to gain unauthorized access to sensitive information.
The vulnerability exists due to improper access restrictions. A remote attacker who have obtained access to administrator's session to access certain administrative resources without needing to re-authenticate to pass "WebSudo".
2) Open redirect (CVE-ID: CVE-2018-13401)
The vulnerability allows a remote unauthenticated attacker to redirect the target user to external websites.The weakness exists due to open redirect. A remote attacker can trick the victim into visiting a specially crafted website, redirect users to malicious website to obtain a user's Cross-site request forgery (CSRF) token.
3) Open redirect (CVE-ID: CVE-2018-13402)
The vulnerability allows a remote unauthenticated attacker to redirect the target user to external websites.The weakness exists due to open redirect. A remote attacker can trick the victim into visiting a specially crafted website, redirect users to malicious website to obtain a user's Cross-site request forgery (CSRF) token.
Remediation
Install update from vendor's website.