Atlassian JIRA 'Jira-importers-plugin' Multiple Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	102744
Class:	Input Validation Error
CVE:	CVE-2017-18033
Remote:	Yes
Local:	No
Published:	Jan 18 2018 12:00AM
Updated:	Jan 18 2018 12:00AM
Credit:	The vendor reported these issues.
Vulnerable:	Atlassian JIRA 5.0.1 0 Atlassian JIRA 5.0 0 Atlassian JIRA 7.5.3 Atlassian JIRA 7.4.2 Atlassian JIRA 7.2.1 Atlassian JIRA 7.2 Atlassian JIRA 7.1.10 Atlassian JIRA 7.1.9 Atlassian JIRA 7.1.8 Atlassian JIRA 7.1.7 Atlassian JIRA 7.1.6 Atlassian JIRA 7.1.5 Atlassian JIRA 7.1.4 Atlassian JIRA 7.1.2 Atlassian JIRA 7.1.1 Atlassian JIRA 7.1 Atlassian JIRA 7.0.11 Atlassian JIRA 7.0.4 Atlassian JIRA 7.0.3 Atlassian JIRA 6.4.11 Atlassian JIRA 6.4.8 Atlassian JIRA 6.3.5 Atlassian JIRA 6.2.7 Atlassian JIRA 6.2.5 Atlassian JIRA 6.1.4 Atlassian JIRA 6.1.3 Atlassian JIRA 6.0.3 Atlassian JIRA 6.0.2 Atlassian JIRA 6.0 Atlassian JIRA 5.1.5 Atlassian JIRA 5.1.4 Atlassian JIRA 5.1.1 Atlassian JIRA 5.1 Atlassian JIRA 5.0.6 Atlassian JIRA 4.4.5 Atlassian JIRA 4.3.4 Atlassian JIRA 4.3.3 Atlassian JIRA 4.2.4 Atlassian JIRA 4.2.2 Atlassian JIRA 4.2.1 Atlassian JIRA 4.1.2 Atlassian JIRA 4.1.1 Atlassian JIRA 4.0.2 Atlassian JIRA 4.0.1 Atlassian JIRA 7.6.0 Atlassian JIRA 7.2.2 Atlassian JIRA 6.3 Atlassian JIRA 6.0.7 Atlassian JIRA 6.0.5 Atlassian JIRA 6.0.4 Atlassian JIRA 6.0.1 Atlassian JIRA 4.4 Atlassian JIRA 4.3 Atlassian JIRA 4.2 Atlassian JIRA 4.1 Atlassian JIRA 4.0
Not Vulnerable:	Atlassian JIRA 7.6.1

Atlassian JIRA 'Jira-importers-plugin' Multiple Cross Site Request Forgery Vulnerabilities

Atlassian JIRA is prone to multiple cross-site request-forgery vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.

Versions prior to Atlassian JIRA 7.6.1 are vulnerable.

Atlassian JIRA 'Jira-importers-plugin' Multiple Cross Site Request Forgery Vulnerabilities

Attackers can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.

Atlassian JIRA 'Jira-importers-plugin' Multiple Cross Site Request Forgery Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Atlassian JIRA 'Jira-importers-plugin' Multiple Cross Site Request Forgery Vulnerabilities

References:

• Atlassian Homepage (Atlassian)
  
• Various Cross-site request forgery(CSRF) vulnerabilities in the Jira-importers-p (Atlassian)