Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF) vulnerability. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.0. It is, therefore, affected by a vulnerability which permits remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF) vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 7.13.9, or version 8.0.x prior to 8.4.2. It is, therefore, affected by a multiple vulnerabilities.

  - A remote attackers to modify Wallboard settings via a Cross-site request forgery (XSRF) vulnerability.
    (CVE-2019-20411)

  - A remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability     on the UserPickerBrowser.jspa page. (CVE-2019-20413)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
113762	Atlassian Jira 8.0.0 < 8.5.0 Csrf On Wallboard Endpoint	Web App Scanning	Component Vulnerability	medium
113761	Atlassian Jira 7.13.0 < 7.13.9 Csrf On Wallboard Endpoint	Web App Scanning	Component Vulnerability	medium
139003	Atlassian Jira < 7.13.9 / 8.0.x < 8.4.2 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2019-20411

medium

Tenable Plugins

medium

medium

medium