CVE-2018-13401

MEDIUM

Atlassian Jira Open Redirect via XsrfErrorAction Resource

Title source: llm

Description

The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allows remote attackers to obtain a user's Cross-site request forgery (CSRF) token through an open redirect vulnerability.

References (2)

Core 2

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/105751

Issue Tracking, Vendor Advisory x_refsource_confirm

https://jira.atlassian.com/browse/JRASERVER-68139

Scores

CVSS v3 6.1

EPSS 0.0009

EPSS Percentile 24.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-601

Status published

Products (2)

atlassian/jira < 7.6.9

atlassian/jira_server 7.7.0 - 7.7.5

Published Oct 23, 2018

Tracked Since Feb 18, 2026