CVE-2018-13401 - Vulnerability Details

Vendors	Products
Atlassian	Jira Jira Server

Link	Providers
http://www.securityfocus.com/bid/105751
https://jira.atlassian.com/browse/JRASERVER-68139

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Jira", "vendor": "Atlassian", "versions": [{"lessThan": "7.6.9", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "7.7.0", "versionType": "custom"}, {"lessThan": "7.7.5", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "7.8.0", "versionType": "custom"}, {"lessThan": "7.8.5", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "7.9.0", "versionType": "custom"}, {"lessThan": "7.9.3", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "7.10.0", "versionType": "custom"}, {"lessThan": "7.10.3", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "7.11.0", "versionType": "custom"}, {"lessThan": "7.11.3", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "7.12.0", "versionType": "custom"}, {"lessThan": "7.12.3", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "7.13.0", "versionType": "custom"}, {"lessThan": "7.13.1", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2018-10-23T00:00:00", "descriptions": [{"lang": "en", "value": "The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allows remote attackers to obtain a user's Cross-site request forgery (CSRF) token through an open redirect vulnerability."}], "problemTypes": [{"descriptions": [{"description": "URL Redirection to Untrusted Site ('Open Redirect')", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-30T09:57:01", "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian"}, "references": [{"name": "105751", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/105751"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://jira.atlassian.com/browse/JRASERVER-68139"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@atlassian.com", "DATE_PUBLIC": "2018-10-23T00:00:00", "ID": "CVE-2018-13401", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Jira", "version": {"version_data": [{"version_affected": "<", "version_value": "7.6.9"}, {"version_affected": ">=", "version_value": "7.7.0"}, {"version_affected": "<", "version_value": "7.7.5"}, {"version_affected": ">=", "version_value": "7.8.0"}, {"version_affected": "<", "version_value": "7.8.5"}, {"version_affected": ">=", "version_value": "7.9.0"}, {"version_affected": "<", "version_value": "7.9.3"}, {"version_affected": ">=", "version_value": "7.10.0"}, {"version_affected": "<", "version_value": "7.10.3"}, {"version_affected": ">=", "version_value": "7.11.0"}, {"version_affected": "<", "version_value": "7.11.3"}, {"version_affected": ">=", "version_value": "7.12.0"}, {"version_affected": "<", "version_value": "7.12.3"}, {"version_affected": ">=", "version_value": "7.13.0"}, {"version_affected": "<", "version_value": "7.13.1"}]}}]}, "vendor_name": "Atlassian"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allows remote attackers to obtain a user's Cross-site request forgery (CSRF) token through an open redirect vulnerability."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "URL Redirection to Untrusted Site ('Open Redirect')"}]}]}, "references": {"reference_data": [{"name": "105751", "refsource": "BID", "url": "http://www.securityfocus.com/bid/105751"}, {"name": "https://jira.atlassian.com/browse/JRASERVER-68139", "refsource": "CONFIRM", "url": "https://jira.atlassian.com/browse/JRASERVER-68139"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T09:00:35.157Z"}, "title": "CVE Program Container", "references": [{"name": "105751", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/105751"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://jira.atlassian.com/browse/JRASERVER-68139"}]}]}, "cveMetadata": {"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "assignerShortName": "atlassian", "cveId": "CVE-2018-13401", "datePublished": "2018-10-23T14:00:00Z", "dateReserved": "2018-07-06T00:00:00", "dateUpdated": "2024-09-17T03:13:21.525Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Jira (string)

vendor : Atlassian (string)

versions : [ »

0 : { »

lessThan : 7.6.9 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

1 : { »

lessThan : unspecified (string)

status : affected (string)

version : 7.7.0 (string)

versionType : custom (string)

}

2 : { »

lessThan : 7.7.5 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

3 : { »

lessThan : unspecified (string)

status : affected (string)

version : 7.8.0 (string)

versionType : custom (string)

}

4 : { »

lessThan : 7.8.5 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

5 : { »

lessThan : unspecified (string)

status : affected (string)

version : 7.9.0 (string)

versionType : custom (string)

}

6 : { »

lessThan : 7.9.3 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

7 : { »

lessThan : unspecified (string)

status : affected (string)

version : 7.10.0 (string)

versionType : custom (string)

}

8 : { »

lessThan : 7.10.3 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

9 : { »

lessThan : unspecified (string)

status : affected (string)

version : 7.11.0 (string)

versionType : custom (string)

}

10 : { »

lessThan : 7.11.3 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

11 : { »

lessThan : unspecified (string)

status : affected (string)

version : 7.12.0 (string)

versionType : custom (string)

}

12 : { »

lessThan : 7.12.3 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

13 : { »

lessThan : unspecified (string)

status : affected (string)

version : 7.13.0 (string)

versionType : custom (string)

}

14 : { »

lessThan : 7.13.1 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

]

}

]

datePublic : 2018-10-23T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allows remote attackers to obtain a user's Cross-site request forgery (CSRF) token through an open redirect vulnerability. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : URL Redirection to Untrusted Site ('Open Redirect') (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2018-10-30T09:57:01 (string)

orgId : f08a6ab8-ed46-4c22-8884-d911ccfe3c66 (string)

shortName : atlassian (string)

}

references : [ »

0 : { »

name : 105751 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

]

url : http://www.securityfocus.com/bid/105751 (string)

}

1 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://jira.atlassian.com/browse/JRASERVER-68139 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : security@atlassian.com (string)

DATE_PUBLIC : 2018-10-23T00:00:00 (string)

ID : CVE-2018-13401 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Jira (string)

version : { »

version_data : [ »

0 : { »

version_affected : < (string)

version_value : 7.6.9 (string)

}

1 : { »

version_affected : >= (string)

version_value : 7.7.0 (string)

}

2 : { »

version_affected : < (string)

version_value : 7.7.5 (string)

}

3 : { »

version_affected : >= (string)

version_value : 7.8.0 (string)

}

4 : { »

version_affected : < (string)

version_value : 7.8.5 (string)

}

5 : { »

version_affected : >= (string)

version_value : 7.9.0 (string)

}

6 : { »

version_affected : < (string)

version_value : 7.9.3 (string)

}

7 : { »

version_affected : >= (string)

version_value : 7.10.0 (string)

}

8 : { »

version_affected : < (string)

version_value : 7.10.3 (string)

}

9 : { »

version_affected : >= (string)

version_value : 7.11.0 (string)

}

10 : { »

version_affected : < (string)

version_value : 7.11.3 (string)

}

11 : { »

version_affected : >= (string)

version_value : 7.12.0 (string)

}

12 : { »

version_affected : < (string)

version_value : 7.12.3 (string)

}

13 : { »

version_affected : >= (string)

version_value : 7.13.0 (string)

}

14 : { »

version_affected : < (string)

version_value : 7.13.1 (string)

}

]

}

]

}

vendor_name : Atlassian (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allows remote attackers to obtain a user's Cross-site request forgery (CSRF) token through an open redirect vulnerability. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : URL Redirection to Untrusted Site ('Open Redirect') (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : 105751 (string)

refsource : BID (string)

url : http://www.securityfocus.com/bid/105751 (string)

}

1 : { »

name : https://jira.atlassian.com/browse/JRASERVER-68139 (string)

refsource : CONFIRM (string)

url : https://jira.atlassian.com/browse/JRASERVER-68139 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-05T09:00:35.157Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

name : 105751 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

2 : x_transferred (string)

]

url : http://www.securityfocus.com/bid/105751 (string)

}

1 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://jira.atlassian.com/browse/JRASERVER-68139 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : f08a6ab8-ed46-4c22-8884-d911ccfe3c66 (string)

assignerShortName : atlassian (string)

cveId : CVE-2018-13401 (string)

datePublished : 2018-10-23T14:00:00Z (string)

dateReserved : 2018-07-06T00:00:00 (string)

dateUpdated : 2024-09-17T03:13:21.525Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*", "matchCriteriaId": "25E9DDE1-F33F-4F65-A521-807D4F09C0AE", "versionEndExcluding": "7.6.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "300D871F-7128-41F1-BCC8-BE7C3687741B", "versionEndExcluding": "7.7.5", "versionStartIncluding": "7.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "A04E4050-271E-4D23-B988-E02D5A651386", "versionEndExcluding": "7.8.5", "versionStartIncluding": "7.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "2A3C3F9E-5BDD-48F3-B45F-9B9C6D31CAE2", "versionEndExcluding": "7.9.3", "versionStartIncluding": "7.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "C568973F-5079-49ED-928D-7F11C842CF4B", "versionEndExcluding": "7.10.3", "versionStartIncluding": "7.10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "551A5667-1184-4E3D-9AA7-90C8D18590C3", "versionEndExcluding": "7.11.3", "versionStartIncluding": "7.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "078CC169-BA97-4F89-A9AE-05E21FC867CA", "versionEndExcluding": "7.12.3", "versionStartIncluding": "7.12.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "C0A81285-A452-4AFE-94BE-3B27014535A3", "versionEndExcluding": "7.13.1", "versionStartIncluding": "7.13.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allows remote attackers to obtain a user's Cross-site request forgery (CSRF) token through an open redirect vulnerability."}, {"lang": "es", "value": "El recurso XsrfErrorAction en Atlassian Jira en versiones anteriores a la 7.6.9, desde la versi\u00f3n 7.7.0 anterior a la 7.7.5, desde la versi\u00f3n 7.8.0 anterior a la 7.8.5, desde la versi\u00f3n 7.9.0 anterior a la 7.9.3, desde la versi\u00f3n 7.10.0 anterior a la 7.10.3, desde la versi\u00f3n 7.11.0 anterior a la 7.11.3, desde la versi\u00f3n 7.12.0 anterior a la 7.12.3 y antes de la versi\u00f3n 7.13.1 permite que atacantes remotos obtengan el token Cross-Site Request Forgery (CSRF) de un usuario a trav\u00e9s de una vulnerabilidad de redirecci\u00f3n abierta."}], "id": "CVE-2018-13401", "lastModified": "2024-11-21T03:47:01.970", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-10-23T13:29:03.040", "references": [{"source": "security@atlassian.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/105751"}, {"source": "security@atlassian.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/JRASERVER-68139"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/105751"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/JRASERVER-68139"}], "sourceIdentifier": "security@atlassian.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 25E9DDE1-F33F-4F65-A521-807D4F09C0AE (string)

versionEndExcluding : 7.6.9 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 300D871F-7128-41F1-BCC8-BE7C3687741B (string)

versionEndExcluding : 7.7.5 (string)

versionStartIncluding : 7.7.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* (string)

matchCriteriaId : A04E4050-271E-4D23-B988-E02D5A651386 (string)

versionEndExcluding : 7.8.5 (string)

versionStartIncluding : 7.8.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 2A3C3F9E-5BDD-48F3-B45F-9B9C6D31CAE2 (string)

versionEndExcluding : 7.9.3 (string)

versionStartIncluding : 7.9.0 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* (string)

matchCriteriaId : C568973F-5079-49ED-928D-7F11C842CF4B (string)

versionEndExcluding : 7.10.3 (string)

versionStartIncluding : 7.10.0 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 551A5667-1184-4E3D-9AA7-90C8D18590C3 (string)

versionEndExcluding : 7.11.3 (string)

versionStartIncluding : 7.11.0 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 078CC169-BA97-4F89-A9AE-05E21FC867CA (string)

versionEndExcluding : 7.12.3 (string)

versionStartIncluding : 7.12.0 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* (string)

matchCriteriaId : C0A81285-A452-4AFE-94BE-3B27014535A3 (string)

versionEndExcluding : 7.13.1 (string)

versionStartIncluding : 7.13.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allows remote attackers to obtain a user's Cross-site request forgery (CSRF) token through an open redirect vulnerability. (string)

}

1 : { »

lang : es (string)

value : El recurso XsrfErrorAction en Atlassian Jira en versiones anteriores a la 7.6.9, desde la versión 7.7.0 anterior a la 7.7.5, desde la versión 7.8.0 anterior a la 7.8.5, desde la versión 7.9.0 anterior a la 7.9.3, desde la versión 7.10.0 anterior a la 7.10.3, desde la versión 7.11.0 anterior a la 7.11.3, desde la versión 7.12.0 anterior a la 7.12.3 y antes de la versión 7.13.1 permite que atacantes remotos obtengan el token Cross-Site Request Forgery (CSRF) de un usuario a través de una vulnerabilidad de redirección abierta. (string)

}

]

id : CVE-2018-13401 (string)

lastModified : 2024-11-21T03:47:01.970 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : MEDIUM (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : NONE (string)

baseScore : 5.8 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:M/Au:N/C:P/I:P/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 8.6 (number)

impactScore : 4.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : true (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.1 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.0 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 2.7 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2018-10-23T13:29:03.040 (string)

references : [ »

0 : { »

source : security@atlassian.com (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : http://www.securityfocus.com/bid/105751 (string)

}

1 : { »

source : security@atlassian.com (string)

tags : [ »

0 : Issue Tracking (string)

1 : Vendor Advisory (string)

]

url : https://jira.atlassian.com/browse/JRASERVER-68139 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : http://www.securityfocus.com/bid/105751 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Issue Tracking (string)

1 : Vendor Advisory (string)

]

url : https://jira.atlassian.com/browse/JRASERVER-68139 (string)

}

]

sourceIdentifier : security@atlassian.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-601 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object