The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3.7, from version 5.4.0 before 5.4.13, and from version 6.0.0 before 6.0.5 disclosed application link information to non-admin users via a missing permissions check.

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.13.6, 6.14.x < 6.15.5 or 7.0.x < 7.0.1. It is, therefore, affected by a missing permissions check vulnerability allowing remote attackers to obtain information about configured application links.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is 8.4.x prior to 8.4.2. It is, therefore, affected by multiple vulnerabilities:

  - An information disclosure vulnerability in the listEntityLinks     servlet resource of the Application links plugin discloses     application link information to non-admin users via a missing     permissions check. (CVE-2019-15011)

  - The WorkflowResource class removeStatus method in Jira before     version 7.13.12, from version 8.0.0 before version 8.4.3, and     from version 8.5.0 before version 8.5.2 allows authenticated     remote attackers who do not have project administration access     to remove a configured issue status from a project via a     missing authorization check. (CVE-2019-15013)

ID	Name	Product	Family	Type	Severity
112871	Atlassian Confluence 7.0.x < 7.0.1 Information Disclosure	Web App Scanning	Component Vulnerability	Version Based	medium
112870	Atlassian Confluence 6.14.x < 6.15.5 Information Disclosure	Web App Scanning	Component Vulnerability	Version Based	medium
112869	Atlassian Confluence < 6.13.6 Information Disclosure	Web App Scanning	Component Vulnerability	Version Based	medium
132320	Atlassian JIRA < 8.4.2 Information disclosure in Application links plugin	Nessus	CGI abuses	Combined	medium

Detections

Analytics

CVE-2019-15011

medium

Tenable Plugins

medium

medium

medium

medium