What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2019-20105.

What is the severity level of CVE-2019-20105?

The severity level of CVE-2019-20105 is medium with a CVSS score of 4.9.

Which software versions are affected by CVE-2019-20105?

The Atlassian Application Links plugin is affected before version 5.4.20, from version 6.0.0 to 6.0.12, from version 6.1.0 to 6.1.2, from version 7.0.0 to 7.0.1, and from version 7.1.0 to 7.1.3.

How can remote attackers exploit CVE-2019-20105?

Remote attackers who have obtained a path to the instance can exploit the vulnerability through the EditApplinkServlet resource.

Are there any patches or updates available to fix this vulnerability?

Yes, upgrading to version 5.4.20 or higher, 6.0.12 or higher, 6.1.2 or higher, 7.0.1 or higher, or 7.1.3 or higher of the Atlassian Application Links plugin will fix this vulnerability.

Vulnerability/
CVE-2019-20105

medium

4.9

CWE

306

17/3/2020

5/8/2024

CVE-2019-20105

First published: Tue Mar 17 2020(Updated: )

The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.1, and from version 7.1.0 before version 7.1.3 allows remote attackers who have obtained access to administrator's session to access the EditApplinkServlet resource without needing to re-authenticate to pass "WebSudo" in products that support "WebSudo" through an improper access control vulnerability.

Credit: security@atlassian.com

Affected Software	Affected Version	How to fix
Atlassian Application Links	<=5.4.20
Atlassian Application Links	>=6.0.0<=6.0.12
Atlassian Application Links	>=6.1.0<6.1.2
Atlassian Application Links	>=7.1.0<7.1.3
Atlassian Application Links	=7.0.0

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2019-20105.
What is the severity level of CVE-2019-20105?
The severity level of CVE-2019-20105 is medium with a CVSS score of 4.9.
Which software versions are affected by CVE-2019-20105?
The Atlassian Application Links plugin is affected before version 5.4.20, from version 6.0.0 to 6.0.12, from version 6.1.0 to 6.1.2, from version 7.0.0 to 7.0.1, and from version 7.1.0 to 7.1.3.
How can remote attackers exploit CVE-2019-20105?
Remote attackers who have obtained a path to the instance can exploit the vulnerability through the EditApplinkServlet resource.
Are there any patches or updates available to fix this vulnerability?
Yes, upgrading to version 5.4.20 or higher, 6.0.12 or higher, 6.1.2 or higher, 7.0.1 or higher, or 7.1.3 or higher of the Atlassian Application Links plugin will fix this vulnerability.

collector/nvd-index
agent/type
agent/references
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/author
agent/weakness
agent/first-publish-date
agent/softwarecombine
agent/severity
agent/description
agent/tags
agent/event
vendor/atlassian
canonical/atlassian application links
version/atlassian application links/5.4.20
version/atlassian application links/6.0.0
version/atlassian application links/6.0.12
version/atlassian application links/6.1.0
version/atlassian application links/7.1.0
version/atlassian application links/7.0.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.