Atlassian Jira Service Desk Server up to 4.5.0 Customer Context Filter Request authorization

Summaryinfo

A vulnerability was found in Atlassian Jira Service Desk Server and Jira Service Desk Data Center up to 4.5.0. It has been rated as problematic. The affected element is an unknown function of the component Customer Context Filter. Performing a manipulation as part of Request results in authorization. This vulnerability was named CVE-2019-15003. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Atlassian Jira Service Desk Server and Jira Service Desk Data Center up to 4.5.0 (Bug Tracking Software). This affects an unknown function of the component Customer Context Filter. The manipulation as part of a Request leads to a authorization vulnerability. CWE is classifying the issue as CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. This is going to have an impact on confidentiality. The summary by CVE is:

The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 allows remote attackers with portal access to view arbitrary issues in Jira Service Desk projects via authorization bypass. Note that when the 'Anyone can email the service desk or raise a request in the portal' setting is enabled, an attacker can grant themselves portal access, allowing them to exploit the vulnerability.

The weakness was presented 11/07/2019. This vulnerability is uniquely identified as CVE-2019-15003 since 08/13/2019. It is possible to initiate the attack remotely. The successful exploitation requires a authentication. Neither technical details nor an exploit are publicly available.

Upgrading to version 3.9.17, 3.10.10, 4.2.6, 4.3.5, 4.4.3 or 4.5.1 eliminates this vulnerability.

See VDB-145174 for similar entry. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Bug Tracking Software

Vendor

• Atlassian

Name

• Jira Service Desk Data Center
• Jira Service Desk Server

Version

• 3.9.0
• 3.9.1
• 3.9.2
• 3.9.3
• 3.9.4
• 3.9.5
• 3.9.6
• 3.9.7
• 3.9.8
• 3.9.9
• 3.9.10
• 3.9.11
• 3.9.12
• 3.9.13
• 3.9.14
• 3.9.15
• 3.9.16
• 3.10.0
• 3.10.1
• 3.10.2
• 3.10.3
• 3.10.4
• 3.10.5
• 3.10.6
• 3.10.7
• 3.10.8
• 3.10.9
• 4.0
• 4.1
• 4.2
• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5
• 4.3
• 4.3.0
• 4.3.1
• 4.3.2
• 4.3.3
• 4.3.4
• 4.4
• 4.4.0
• 4.4.1
• 4.4.2
• 4.5.0

License

• free

Website

• Vendor: https://www.atlassian.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion