Vulnerability Details : CVE-2019-20098
Potential exploit
The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to enumerate hosts and open ports on the internal network where Jira server is present.
Vulnerability category: Cross-site request forgery (CSRF)
Products affected by CVE-2019-20098
- cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
- cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-20098
0.56%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 67 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-20098
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST | |
|
4.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
2.8
|
1.4
|
NIST |
CWE ids for CVE-2019-20098
-
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-20098
-
https://www.tenable.com/security/research/tra-2020-05
Atlassian Jira Multiple CSRF - Research Advisory | Tenable®Exploit;Third Party Advisory
-
https://jira.atlassian.com/browse/JRASERVER-70605
[JRASERVER-70605] CSRF in VerifySmtpServerConnection!add.jspa - CVE-2019-20098 - Create and track feature requests for Atlassian products.Issue Tracking;Vendor Advisory
Jump to