CVE-2018-13400
First published: Tue Oct 23 2018(Updated: )
Several administrative resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allow remote attackers who have obtained access to administrator's session to access certain administrative resources without needing to re-authenticate to pass "WebSudo" through an improper access control vulnerability.
Credit: security@atlassian.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Atlassian Jira | <7.6.9 | |
| Atlassian Server | >=7.7.0<7.7.5 | |
| Atlassian Server | >=7.8.0<7.8.5 | |
| Atlassian Server | >=7.9.0<7.9.3 | |
| Atlassian Server | >=7.10.0<7.10.3 | |
| Atlassian Server | >=7.11.0<7.11.3 | |
| Atlassian Server | >=7.12.0<7.12.3 | |
| Atlassian Server | >=7.13.0<7.13.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-13400?
CVE-2018-13400 is classified as a moderate severity vulnerability due to unauthorized access to administrative resources.
How do I fix CVE-2018-13400?
To fix CVE-2018-13400, upgrade Atlassian Jira to versions 7.6.9 or above, or to later versions specified in the advisory.
What versions of Jira are affected by CVE-2018-13400?
CVE-2018-13400 affects Jira versions before 7.6.9 and Jira Server versions between 7.7.0 and 7.7.5, 7.8.0 and 7.8.5, 7.9.0 and 7.9.3, 7.10.0 and 7.10.3, 7.11.0 and 7.11.3, 7.12.0 and 7.12.3, and 7.13.0 and 7.13.1.
What type of vulnerability is CVE-2018-13400?
CVE-2018-13400 is a privilege escalation vulnerability that allows unauthorized users to gain access to administrative features.
Is there a workaround for CVE-2018-13400?
Currently, the recommended action is to upgrade to a secure version, as no specific workaround has been detailed for CVE-2018-13400.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/atlassian
- canonical/atlassian jira
- canonical/atlassian server
- version/atlassian server/7.7.0
- version/atlassian server/7.8.0
- version/atlassian server/7.9.0
- version/atlassian server/7.10.0
- version/atlassian server/7.11.0
- version/atlassian server/7.12.0
- version/atlassian server/7.13.0