CVE-2019-15011 Missing authorization in Application Links
Non-admin users can access sensitive application link information due to a missing permissions check in the ListEntityLinksServlet resource.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-15011?
CVE-2019-15011 is a medium-severity missing authorization vulnerability in Atlassian Application Links, published on 17 Dec 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3.7, from version 5.4.0 before 5.4.13, and from version 6.0.0 before 6.0.5 disclosed application link information to non-admin users via a missing permissions check.
Weakness: CWE-276
Which versions are affected by CVE-2019-15011?
It affects 1 product.
Products include Atlassian Application Links.
How do I fix CVE-2019-15011?
No fix has been published for CVE-2019-15011 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-15011 being exploited?
There is no known exploitation of CVE-2019-15011 in the wild and no public exploit code.
Other vulnerabilities in Atlassian Application Links
- CVE-2017-18111 XML external entity in Application Links
- CVE-2017-18096 Server-side request forgery in Atlassian Application Links
- CVE-2017-16860 Cross-site scripting in Application Links
- CVE-2018-20239 Cross-site scripting in Atlassian Application Links
- CVE-2019-20105 Missing authorization in Application Links
Sources
Also known as CVE-2019-20417, GHSA-2p8c-2cmg-p6f8.