Servers and applications
CVE-2018-13401
The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allows remote attackers to obtain a user's…
- Severity
- Medium 6.1
- Published
- 23 Oct 2018
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 7.8.5, 7.9.3, 7.10.3, 7.11.3, 7.12.3, 7.13.1
- Exploit chance
- 1.5% in the next 30 daysHigher than 73% of CVEs. EPSS by FIRST, 10 Nov 2026
- Weakness
- Open redirect (CWE-601)
- Attack
- Over the network · No login needed · Needs someone to click or open something
- Attacker can
- Read some data · Change some data
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Sources
- NVD
Description
The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allows remote attackers to obtain a user's Cross-site request forgery (CSRF) token through an open redirect vulnerability.
Affected software
| Software | Affected versions |
|---|---|
JiraServers and applications · cpe:a:atlassian:jira |
|
JiraServers and applications · cpe:a:atlassian:jira_server |
All 7 release lines
|