Atlassian JIRA Multiple Security Vulnerabilities
BID:55253
Info
Atlassian JIRA Multiple Security Vulnerabilities
| Bugtraq ID: | 55253 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 29 2012 12:00AM |
| Updated: | Aug 29 2012 12:00AM |
| Credit: | Vendor, Conrad Rolack, Brandon Sterne and Joao Paulo Lins. |
| Vulnerable: |
Atlassian JIRA 5.0.1 0 Atlassian JIRA 5.0 0 Atlassian JIRA 4.2.2 Atlassian JIRA 4.2.1 Atlassian JIRA 4.4 Atlassian JIRA 4.3 |
| Not Vulnerable: | |
Discussion
Atlassian JIRA Multiple Security Vulnerabilities
Atlassian JIRA is prone to multiple security vulnerabilities that includes:
1. A security-bypass vulnerability
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. A URI open-redirection vulnerability
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, redirect a user to a potentially malicious site, perform unauthorized actions, and bypass intended security protections in the context of the affected application.
Atlassian JIRA is prone to multiple security vulnerabilities that includes:
1. A security-bypass vulnerability
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. A URI open-redirection vulnerability
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, redirect a user to a potentially malicious site, perform unauthorized actions, and bypass intended security protections in the context of the affected application.
Exploit / POC
Atlassian JIRA Multiple Security Vulnerabilities
An attacker can exploit these issues through a browser. To exploit cross-site request forgery and cross-site scripting issues, the attacker must entice an unsuspecting victim to follow a malicious URI.
An attacker can exploit these issues through a browser. To exploit cross-site request forgery and cross-site scripting issues, the attacker must entice an unsuspecting victim to follow a malicious URI.
Solution / Fix
Atlassian JIRA Multiple Security Vulnerabilities
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
Atlassian JIRA Multiple Security Vulnerabilities
References:
References: