According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.4.0. It is, therefore, affected by multiple vulnerabilities:

 - A cross-site scripting (XSS) vulnerability exists in the WikiRenderer parser. A remote attacker can exploit this by creating a specially crafted request that executes arbitrary script code in a user's browser session. (CVE-2019-8444)

 - An information disclosure vulnerability exists in the /rest/api/2/worklog/list rest resource. An authenticated, remote attacker can exploit this, to view worklog details for issues they do not have permission to view. (CVE-2019-8445)

 - An information disclosure vulnerability exists in the /rest/issueNav/1/issueTable rest resource. A remote anonymous attackers can exploit this to differentiate between valid usernames and invalid usernames. (CVE-2019-8446)

 - An information disclosure vulnerability exists in the /rest/api/latest/groupuserpicker resource. An unauthenticated, remote attacker can exploit this, to enumerate usernames due to an incorrect authorization check. (CVE-2019-8449)

 - A server-side request forgery (SSRF) vulnerability exists in the /plugins/servlet/gadgets/makeRequest resource due to a logic bug in the JiraWhitelist class. A remote attacker can exploit this to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability. (CVE-2019-8451)

 - An authentication bypass vulnerability exists in the /rest/api/1.0/render rest resource. An unauthenticated, remote attacker can exploit this, to determine if an attachment with a specific name exists and if an issue key is valid due to a missing permissions check. (CVE-2019-14995)

 - An information disclosure vulnerability exists in the AccessLogFilter class due to a caching vulnerability. A remote anonymous attackers can exploit this to access details about other users, including their username, when Jira is configured with a reverse Proxy and or a load balancer with caching or a CDN. (CVE-2019-14997)

 - A cross-site request forgery (XSRF) vulnerability exists in Webwork action Cross-Site Request Forgery (CSRF) protection. A remote attacker can exploit this by bypassing its protection by 'cookie tossing' a CSRF cookie from a subdomain of a Jira instance. (CVE-2019-14998)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, The version of Atlassian JIRA hosted on the remote web server is 7.6 < 8.3.2. It is therefore affected by the following vulnerabilities:

  - An incorrect authorization check on the /rest/issueNav/1/issueTable resource     in Jira allows remote attackers to enumerate usernames. (CVE-2019-8446)

  - A cross-site request forgery (XSRF) vulnerability exists in Jira due to     ServiceExecutor. A remote attacker can exploit this to trigger the creation     of export files. (CVE-2019-8447)

  - A cross-site scripting (XSS) vulnerability exists due to improper validation of priority     icon url of issue priority. An unauthenticated, remote attacker can exploit this,     by convincing a user to click a specially crafted URL, to execute arbitrary script code     in a user's browser session. (CVE-2019-11584)   
  - An information disclosure vulnerability exists in the Atlassian     Troubleshooting and Support Tools plugin due to a missing     authorization check. An authenticated, remote attacker     can exploit this to initiate periodic log scans and send the     results to a user-specified email address disclosing configuration     information.(CVE-2019-15005)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
98726	Atlassian Jira < 8.4.0 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	10/9/2019	3/14/2023	medium
129589	Atlassian JIRA < 8.3.2 Multiple Vulnerabilities	Nessus	CGI abuses	10/4/2019	4/19/2024	medium

Detections

Analytics

Plugins Search

medium

medium