CVE-2018-13404 Server-side request forgery in Jira
Administrators can exploit an SSRF vulnerability in Jira to scan internal networks and access internal service information.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-13404?
CVE-2018-13404 is a medium-severity server-side request forgery vulnerability in Atlassian Jira, published on 13 Feb 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The VerifyPopServerConnection resource in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and from version 7.13.0 before version 7.13.1 allows remote attackers who have administrator rights to determine the existence of internal hosts & open ports and in some cases obtain service information from internal network resources via a Server Side Request Forgery (SSRF) vulnerability.
Weakness: CWE-918
Which versions are affected by CVE-2018-13404?
It affects 2 products.
Products include Atlassian Jira, Atlassian Jira Server.
How do I fix CVE-2018-13404?
No fix has been published for CVE-2018-13404 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2018-13404 being exploited?
There is no known exploitation of CVE-2018-13404 in the wild and no public exploit code.
Other vulnerabilities in Atlassian Jira
Sources
Also known as GHSA-5pg5-2rp3-4hw8.