CVE-2018-13400

MEDIUM

Atlassian Jira < 7.6.9 - Improper Privilege Management

Title source: rule

Description

Several administrative resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allow remote attackers who have obtained access to administrator's session to access certain administrative resources without needing to re-authenticate to pass "WebSudo" through an improper access control vulnerability.

References (2)

Core 2

Core References

Issue Tracking, Vendor Advisory x_refsource_confirm

https://jira.atlassian.com/browse/JRASERVER-68138

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/105751

Scores

CVSS v3 4.7

EPSS 0.0026

EPSS Percentile 49.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Details

CWE

CWE-269

Status published

Products (2)

atlassian/jira < 7.6.9

atlassian/jira_server 7.7.0 - 7.7.5

Published Oct 23, 2018

Tracked Since Feb 18, 2026