CVE-2019-20105: Medium severity Atlassian Application Links vulnerability
The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.1, and from version 7.1.0 before version 7.1.3 allows remote attackers who have obtained access to administrator's session to access the EditApplinkServlet resource without needing to re-authenticate to pass "WebSudo" in products that support "WebSudo" through an improper access control vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2019-20105.
What is the severity level of CVE-2019-20105?
The severity level of CVE-2019-20105 is medium with a CVSS score of 4.9.
Which software versions are affected by CVE-2019-20105?
The Atlassian Application Links plugin is affected before version 5.4.20, from version 6.0.0 to 6.0.12, from version 6.1.0 to 6.1.2, from version 7.0.0 to 7.0.1, and from version 7.1.0 to 7.1.3.
How can remote attackers exploit CVE-2019-20105?
Remote attackers who have obtained a path to the instance can exploit the vulnerability through the EditApplinkServlet resource.
Are there any patches or updates available to fix this vulnerability?
Yes, upgrading to version 5.4.20 or higher, 6.0.12 or higher, 6.1.2 or higher, 7.0.1 or higher, or 7.1.3 or higher of the Atlassian Application Links plugin will fix this vulnerability.