The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8.5.2 allows authenticated remote attackers who do not have project administration access to remove a configured issue status from a project via a missing authorisation check.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to version 7.13.12 , 8.0.0 prior to 8.4.3 or 8.5.0 prior to 8.5.2. It is, therefore, affected by a vulnerability which permits authenticated remote attackers who do not have project administration access to remove a configured issue status from a project via a missing authorisation check.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is prior to 7.13.12, 8.x prior to 8.4.3, or 8.5.x prior to 8.5.2 / 8.6.0. It is, therefore, affected by an authorization bypass vulnerability. The vulnerability exists in the WorkflowResource class removeStatus method due to a missing authorization check. An authenticated, remote attacker can exploit this with a non-privileged account to bypass required administrative permissions and remove a configured issue status from a project.

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is 8.4.x prior to 8.4.2. It is, therefore, affected by multiple vulnerabilities:

  - An information disclosure vulnerability in the listEntityLinks     servlet resource of the Application links plugin discloses     application link information to non-admin users via a missing     permissions check. (CVE-2019-15011)

  - The WorkflowResource class removeStatus method in Jira before     version 7.13.12, from version 8.0.0 before version 8.4.3, and     from version 8.5.0 before version 8.5.2 allows authenticated     remote attackers who do not have project administration access     to remove a configured issue status from a project via a     missing authorization check. (CVE-2019-15013)

ID	Name	Product	Family	Severity
113775	Atlassian Jira 8.5.0 < 8.5.2 Improper Authorization In Workflowresource Class	Web App Scanning	Component Vulnerability	medium
113774	Atlassian Jira 8.0.0 < 8.4.3 Improper Authorization In Workflowresource Class	Web App Scanning	Component Vulnerability	medium
113773	Atlassian Jira 7.13.0 < 7.13.12 Improper Authorization In Workflowresource Class	Web App Scanning	Component Vulnerability	medium
132727	Atlassian JIRA < 7.13.12 / 8.x < 8.4.3 / 8.5.x < 8.5.2 Authorization Bypass (JRASERVER-70405)	Nessus	CGI abuses	medium
132320	Atlassian JIRA < 8.4.2 Information disclosure in Application links plugin	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2019-15013

medium

Tenable Plugins

medium

medium

medium

medium

medium