QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2019-20105

Back to search

CVE-2019-20105

Published: Mar 17, 2020

Modified: Sep 16, 2024

PUBLISHED

Description

The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.1, and from version 7.1.0 before version 7.1.3 allows remote attackers who have obtained access to administrator's session to access the EditApplinkServlet resource without needing to re-authenticate to pass "WebSudo" in products that support "WebSudo" through an improper access control vulnerability.

VendorProductVersions

Atlassian

Application Links

affected
unspecified - < 5.4.20
affected
6.0.0 - < unspecified
affected
unspecified - < 6.0.12
affected
7.0.0 - < unspecified
affected
unspecified - < 7.0.1

+2 more versions

Atlassian

Jira Server and Data Center

affected
7.13.8 - < unspecified
affected
unspecified - < 7.13.12
affected
8.4.2 - < unspecified
affected
unspecified - < 8.5.4
affected
8.6.0 - < unspecified

+1 more versions

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now