Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability on the UserPickerBrowser.jspa page. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is version 7.0.8 prior to 7.13.9 or 8.0.0 prior to 8.5.0. It is, therefore, affected by a vulnerability which permits remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability on the UserPickerBrowser.jspa page.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 7.13.9, or version 8.0.x prior to 8.4.2. It is, therefore, affected by a multiple vulnerabilities.

  - A remote attackers to modify Wallboard settings via a Cross-site request forgery (XSRF) vulnerability.
    (CVE-2019-20411)

  - A remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability     on the UserPickerBrowser.jspa page. (CVE-2019-20413)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
113760	Atlassian 8.0.0 < 8.5.0 DoS Via Missing Input Validation In Userpickerbrowser	Web App Scanning	Component Vulnerability	high
113759	Atlassian Jira 7.0.8 < 7.13.9 DoS Via Missing Input Validation In Userpickerbrowser	Web App Scanning	Component Vulnerability	high
139003	Atlassian Jira < 7.13.9 / 8.0.x < 8.4.2 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2019-20413

high

Tenable Plugins

high

high

medium