Description

The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allows remote attackers to obtain a user's Cross-site request forgery (CSRF) token through an open redirect vulnerability.

Remediation

References

CVE-2018-13401

Related Vulnerabilities

PHP Uncontrolled Resource Consumption Vulnerability (CVE-2011-3336)

Jboss EAP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-14642)

MediaWiki Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2024-40603)

Oracle Database Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2007-0275)

WordPress Plugin Content Control-User Access Restriction Cross-Site Scripting (1.1.9)

Severity

Medium

Classification

CVE-2018-13401 CWE-601

Tags

Missing Update Known Vulnerabilities