CVE-2019-15002

Published: Feb 11, 2025Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. The login form doesn’t require a CSRF token. As a result, an attacker can log a user into the system under an unexpected account.

Affected (2)

Products: Atlassian: Jira Data Center, Jira Server

Atlassian

2 products

Jira Data Center

Jira Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Atlassian Jira Data Center	From 7.6.4 to 8.1.0
Atlassian Jira Server	From 7.6.4 to 8.1.0

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (1)

https://jira.atlassian.com/browse/JRASERVER-67979

Source: security@atlassian.com

Issue TrackingVendor Advisory

Timeline

No history available yet.