Various administrative external system import resources in Atlassian JIRA Server (including JIRA Core) before version 7.6.5, from version 7.7.0 before version 7.7.3, from version 7.8.0 before version 7.8.3 and before version 7.9.0 allow remote attackers to run import operations and to determine if an internal service exists through missing permission checks.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 7.6.5, 7.7.0 prior to 7.7.3 or 7.8.0 prior to 7.8.4. It is, therefore, affected by a vulnerability which permits remote attackers to run import operations and to determine if an internal service exists through missing permission checks via administrative eternal system import resources.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by an authentication bypass on certain administrative resources, which could allow an attacker to run import operations or reveal sensitive information.

ID	Name	Product	Family	Severity
113807	Atlassian Jira 7.8.0 < 7.8.4 Missing Authentication Checks In Administrative System	Web App Scanning	Component Vulnerability	medium
113806	Atlassian Jira 7.7.0 < 7.7.3 Missing Authentication Checks In Administrative System	Web App Scanning	Component Vulnerability	medium
113805	Atlassian Jira < 7.6.5 Missing Authentication Checks In Administrative System	Web App Scanning	Component Vulnerability	medium
122598	Atlassian JIRA < 7.6.5 / 7.7.x < 7.7.3 / 7.8.x < 7.8.3 Limited Authentication Bypass	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2017-18101

medium

Tenable Plugins

medium

medium

medium

medium