Atlassian Jira Service Desk Server up to 4.5.0 Customer Context Filter Request authorization
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
4.7 | $0-$5k | 0.00 |
A vulnerability, which was classified as problematic, was found in Atlassian Jira Service Desk Server and Jira Service Desk Data Center up to 4.5.0 (Bug Tracking Software). This affects an unknown function of the component Customer Context Filter. The manipulation as part of a Request leads to a authorization vulnerability. CWE is classifying the issue as CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. This is going to have an impact on confidentiality. The summary by CVE is:
The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 allows remote attackers with portal access to view arbitrary issues in Jira Service Desk projects via authorization bypass. Note that when the 'Anyone can email the service desk or raise a request in the portal' setting is enabled, an attacker can grant themselves portal access, allowing them to exploit the vulnerability.
The weakness was presented 11/07/2019. This vulnerability is uniquely identified as CVE-2019-15003 since 08/13/2019. It is possible to initiate the attack remotely. The successful exploitation requires a authentication. Neither technical details nor an exploit are publicly available.
Upgrading to version 3.9.17, 3.10.10, 4.2.6, 4.3.5, 4.4.3 or 4.5.1 eliminates this vulnerability.
See 145174 for similar entry.
Product
Type
Vendor
Name
Version
- 3.9.0
- 3.9.1
- 3.9.2
- 3.9.3
- 3.9.4
- 3.9.5
- 3.9.6
- 3.9.7
- 3.9.8
- 3.9.9
- 3.9.10
- 3.9.11
- 3.9.12
- 3.9.13
- 3.9.14
- 3.9.15
- 3.9.16
- 3.10.0
- 3.10.1
- 3.10.2
- 3.10.3
- 3.10.4
- 3.10.5
- 3.10.6
- 3.10.7
- 3.10.8
- 3.10.9
- 4.0
- 4.1
- 4.2
- 4.2.0
- 4.2.1
- 4.2.2
- 4.2.3
- 4.2.4
- 4.2.5
- 4.3
- 4.3.0
- 4.3.1
- 4.3.2
- 4.3.3
- 4.3.4
- 4.4
- 4.4.0
- 4.4.1
- 4.4.2
- 4.5
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 4.8VulDB Meta Temp Score: 4.7
VulDB Base Score: 4.3
VulDB Temp Score: 4.1
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 5.3
NVD Vector: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: AuthorizationCWE: CWE-863 / CWE-285 / CWE-266
ATT&CK: Unknown
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: Jira Service Desk Server/Jira Service Desk Data Center 3.9.17/3.10.10/4.2.6/4.3.5/4.4.3/4.5.1
Timeline
08/13/2019 🔍11/07/2019 🔍
11/07/2019 🔍
02/05/2024 🔍
Sources
Vendor: atlassian.comAdvisory: 155214
Status: Not defined
CVE: CVE-2019-15003 (🔍)
See also: 🔍
Entry
Created: 11/07/2019 10:27Updated: 02/05/2024 12:28
Changes: 11/07/2019 10:27 (39), 11/07/2019 10:31 (18), 02/05/2024 12:28 (5)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.