What is CVE-2019-15013?

CVE-2019-15013 is a medium-severity vulnerability in Atlassian Jira, classified under Missing Authorization. CVSS score: 4.3/10. Published 2019-12-18.

How severe is CVE-2019-15013?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Auth bypass in Atlassian Jira

CVE-2019-15013

The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8.5.2 allows authenticated remote attackers who do not have project administration access to remove a configured issue status from a project via a missing authorisation check.

Vulnerability class: Broken Access Control

EPSS: 0.012 (65.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

Affected products

Atlassian Jira — versions unspecified, 8.0.0, unspecified
Atlassian Jira_server

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

security@atlassian.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2019-15013?: CVE-2019-15013 is a medium-severity vulnerability in Atlassian Jira, classified under Missing Authorization. CVSS score: 4.3/10. Published 2019-12-18.
How severe is CVE-2019-15013?: Medium severity. CVSS v3 base score is 4.3 out of 10.