4.3Medium

CVE-2019-15002

Atlassian Jira Server; Atlassian Jira Data Center Published: 2025-02-11 20:24 (1 year ago)

Description

An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. The login form doesn’t require a CSRF token. As a result, an attacker can log a user into the system under an unexpected account.

Weakness (CWE): CWE-352

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Atlassian	Jira Data Center	unspecified – < 8.1.0
Atlassian	Jira Server	unspecified – < 8.1.0

References and patches

https://jira.atlassian.com/browse/JRASERVER-67979 Issue TrackingVendor Advisory

CPE matches (NVD) (2)

cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* ≥ 7.6.4 ≤ 8.1.0
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* ≥ 7.6.4 ≤ 8.1.0

CVSS score

4.3Medium

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

All scores (2)

CISA-ADP	CVSS 3.1	4.3Medium
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	4.3Medium

EPSS (chance of exploitation in 30 days)

0.32%

higher than 25% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2019-08-13
Published2025-02-11 20:24
Reached IP-DB2026-10-24 23:51
Last updated2026-06-17 05:19

Assigned by (CNA): atlassian
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Atlassian Confluence / Jira

9.3Critical

CVE-2026-21589 KEV 1 month ago

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Atlassian Bamboo Data Center; Atlassian Bitbucket Data Center; Atlassian Confluence Data Center; Atlassian Crowd Data Center

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthent…

100%EPSS

7.1High

CVE-2026-21586 2 months ago

Atlassian Confluence Data Center

This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Improper Authorization vulnerability, with …

7.1High

CVE-2026-21587 2 months ago

Atlassian Jira Service Management Data Center

This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended acces…

7.1High

CVE-2026-21588 2 months ago

Atlassian Confluence Data Center

This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1,…

8.6High

CVE-2026-21580 2 months ago

Atlassian Confluence Data Center; Atlassian Confluence Server

This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 1…

7.1High

CVE-2026-21577 3 months ago

Atlassian Confluence Data Center

This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows …