Vulnerability Description
The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.1, and from version 7.1.0 before version 7.1.3 allows remote attackers who have obtained access to administrator's session to access the EditApplinkServlet resource without needing to re-authenticate to pass "WebSudo" in products that support "WebSudo" through an improper access control vulnerability.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Application Links | <= 5.4.20 |
Related Weaknesses (CWE)
References
- https://ecosystem.atlassian.net/browse/APL-1391Vendor Advisory
- https://jira.atlassian.com/browse/JRASERVER-70526Vendor Advisory
- https://ecosystem.atlassian.net/browse/APL-1391Vendor Advisory
- https://jira.atlassian.com/browse/JRASERVER-70526Vendor Advisory
FAQ
What is CVE-2019-20105?
CVE-2019-20105 is a vulnerability with a CVSS score of 4.9 (MEDIUM). The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 b...
How severe is CVE-2019-20105?
CVE-2019-20105 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-20105?
Check the references section above for vendor advisories and patch information. Affected products include: Atlassian Application Links.