CVE-2019-15013: Medium severity Atlassian Jira vulnerability
The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8.5.2 allows authenticated remote attackers who do not have project administration access to remove a configured issue status from a project via a missing authorisation check.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-15013?
CVE-2019-15013 is classified as a medium severity vulnerability due to its impact on project status configuration.
How do I fix CVE-2019-15013?
To resolve CVE-2019-15013, upgrade your Jira instance to version 7.13.12 or versions 8.4.3 and 8.5.2 or later.
Who is affected by CVE-2019-15013?
CVE-2019-15013 affects authenticated users without project administration access in Jira versions prior to the specified fixed versions.
What kind of access does an attacker need for CVE-2019-15013?
An attacker needs authenticated access to Jira but does not require project administration access to exploit CVE-2019-15013.
What can attackers do with CVE-2019-15013?
Attackers exploiting CVE-2019-15013 can remove configured issue statuses from Jira projects, potentially disrupting project workflows.