Description

The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect in the os_destination parameter.

Remediation

References

CVE-2019-20901

Related Vulnerabilities

WordPress 4.3.x Cross-Site Request Forgery (4.3 - 4.3.18)

Jenkins DEPRECATED: Code Vulnerability (CVE-2016-3721)

WordPress Plugin UsersWP-Front-end login form, User Registration, User Profile & Members Directory for WP Cross-Site Scripting (1.2.2.28)

WordPress Plugin Product Addons & Fields for WooCommerce Cross-Site Scripting (32.0.6)

WordPress Plugin Simple Video Embedder Cross-Site Scripting (2.2)

Severity

Medium

Classification

CVE-2019-20901 CWE-601

Tags

Missing Update Known Vulnerabilities