CVE-2018-13401
Summary
| CVE | CVE-2018-13401 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-10-23 13:29:00 UTC |
| Updated | 2022-03-25 17:22:00 UTC |
| Description | The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allows remote attackers to obtain a user's Cross-site request forgery (CSRF) token through an open redirect vulnerability. |
Risk And Classification
Problem Types: CWE-601
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [JRASERVER-68139] Open redirect in the XsrfErrorAction resource - CVE-2018-13401 - Create and track feature requests for Atlassian products. | CONFIRM | jira.atlassian.com | Issue Tracking, Vendor Advisory |
| Atlassian JIRA Multiple Open Redirect and Access Bypass Vulnerabilities | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 150547 Atlassian Jira Server Multiple Vulnerabilities (OCT-2018)