Description

The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers who have obtained access to administrator's session to access the ViewUpgrades administrative resource without needing to re-authenticate to pass "WebSudo" through an improper access control vulnerability.

Remediation

References

CVE-2019-8443

Related Vulnerabilities

WordPress Plugin Easy Justified Gallery Cross-Site Scripting (1.0.8)

MySQL CVE-2019-2740 Vulnerability (CVE-2019-2740)

Rukovoditel Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2020-13591)

MySQL CVE-2014-6464 Vulnerability (CVE-2014-6464)

Drupal Core 8.3.0 Security Bypass (8.3.0)

Severity

High

Classification

CVE-2019-8443 CWE-287

Tags

Missing Update Known Vulnerabilities