Vulnerability Details : CVE-2019-8443
The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers who have obtained access to administrator's session to access the ViewUpgrades administrative resource without needing to re-authenticate to pass "WebSudo" through an improper access control vulnerability.
Vulnerability category: BypassGain privilege
Products affected by CVE-2019-8443
- cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
- cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
Threat overview for CVE-2019-8443
Top countries where our scanners detected CVE-2019-8443
Top open port discovered on systems with this issue
80
IPs affected by CVE-2019-8443 2,639
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2019-8443!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2019-8443
0.95%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 83 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-8443
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
8.1
|
HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.2
|
5.9
|
NIST |
CWE ids for CVE-2019-8443
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-8443
-
https://jira.atlassian.com/browse/JRASERVER-69240
[JRASERVER-69240] Authorisation bypass in the ViewUpgrades resource - CVE-2019-8443 - Create and track feature requests for Atlassian products.Issue Tracking;Vendor Advisory
-
http://www.securityfocus.com/bid/108458
Atlassian JIRA CVE-2019-8443 Authorization Bypass VulnerabilityBroken Link
Jump to