Security vulnerabilities related to Jira after running an audit check on our server

[omar alashqar]

Can you please help us close the below vulnerabilities :

- Atlassian JIRA: Template injection in Jira Importers Plugin (CVE-2019-15001)
- JIRA Security Advisory 2019-07-10: Jira Server - Template injection in various resources
- Atlassian JIRA: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CVE-2020-14172)
- Atlassian JIRA: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CVE-2019-20409)
- Atlassian JIRA: URL Redirection to Untrusted Site ('Open Redirect') (CVE-2019-20901)
- Atlassian JIRA: Information Exposure (CVE-2019-20417)
- Atlassian JIRA: URL Redirection to Untrusted Site ('Open Redirect') (CVE-2019-11585)
- Atlassian JIRA: URL Redirection to Untrusted Site ('Open Redirect') (CVE-2019-11589)
- Atlassian JIRA: Server-Side Request Forgery (SSRF) (CVE-2019-8451)
- Atlassian JIRA: Unspecified Security Vulnerability (CVE-2019-20899)
- Atlassian JIRA: Improper Input Validation (CVE-2019-20413)
- Atlassian JIRA: Information Exposure (CVE-2019-20898)
- Atlassian JIRA: Incorrect Authorization (CVE-2020-14165)
- Atlassian JIRA: Server-Side Request Forgery (SSRF) (CVE-2019-20408)
- Atlassian JIRA: Improper Authentication (CVE-2019-20412)
- Atlassian JIRA: Information Exposure (CVE-2020-4028)
- Atlassian JIRA: Information Exposure (CVE-2019-20403)
- Atlassian JIRA: Incorrect Default Permissions (CVE-2019-14995)
- Atlassian JIRA: Improper Authorization (CVE-2019-8446)
- Atlassian JIRA: Permission Issues leading to Information Disclosure (CVE-2019-8445)
- Atlassian JIRA: User enumeration through the groupuserpicker api resource (CVE-2019-8449)
- Atlassian JIRA: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2019-20900)
- Atlassian JIRA: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2020-14173)
- Atlassian JIRA: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2020-4024)
- Atlassian JIRA: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2020-4025)
- Atlassian JIRA: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2019-20416)
- Atlassian JIRA: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2019-20414)
- Atlassian JIRA: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2020-4021)
- Atlassian JIRA: Unrestricted Upload of File with Dangerous Type (CVE-2019-20897)
- Atlassian JIRA: Unspecified Security Vulnerability (CVE-2019-20418)
- Atlassian JIRA: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2019-8450)
- Atlassian JIRA: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2019-8444)
- Atlassian JIRA: Incorrect Default Permissions (CVE-2019-20106)
- Atlassian JIRA: Missing Authorization (CVE-2019-15013)
- Atlassian JIRA: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2020-4022)
- Atlassian JIRA: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2020-14164)
- Atlassian JIRA: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2020-14169)
- Atlassian JIRA: Cross-Site Request Forgery (CSRF) (CVE-2019-20411)
- Atlassian JIRA: Cross-Site Request Forgery (CSRF) (CVE-2019-11588)
- Atlassian JIRA: Cross-Site Request Forgery (CSRF) (CVE-2019-20401)
- Atlassian JIRA: Cross-Site Request Forgery (CSRF) (CVE-2019-20405)
- Atlassian JIRA: Cross-Site Request Forgery (CSRF) (CVE-2019-14998)
- Atlassian JIRA: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2019-14996)
- Atlassian JIRA: Cross-Site Request Forgery (CSRF) (CVE-2019-11586)
- Atlassian JIRA: Cross-Site Request Forgery (CSRF) (CVE-2019-11587)
- Atlassian JIRA: Cross-Site Request Forgery (CSRF) (CVE-2019-8447)
- Atlassian JIRA: Untrusted Search Path (CVE-2019-20419)
- Atlassian JIRA: Improper Input Validation (CVE-2020-14174)
- Atlassian JIRA: Incorrect Authorization (CVE-2020-4029)
- Atlassian JIRA: Information Exposure (CVE-2019-20410)
- Atlassian JIRA: Missing Authorization (CVE-2019-15005)
- Atlassian JIRA: Cross-Site Request Forgery (CSRF) (CVE-2019-20098)
- Atlassian JIRA: Cross-Site Request Forgery (CSRF) (CVE-2019-20099)
- Atlassian JIRA: CSRF in Application Links plugin allows network enumeration (CVE-2019-20100)
- Atlassian JIRA: Information Exposure (CVE-2019-14997)

[Daniel Ebers · Accepted solution]

Hi Omar,

whilst I haven't checked every single CVE you have listed the general recommendation is to upgrade to a recent version that then is not affected by a specific CVE anymore.

https://confluence.atlassian.com/adminjiraserver/upgrading-jira-applications-938846936.html

In case it would be a critical CVE it is also listed here along with mitigation options:https://www.atlassian.com/trust/security/advisories

Cheers,
Daniel

[omar alashqar]

Hi Daniel,

Thank you for your suggestion, it actually worked, I did upgrade the Jira Core version and all Jira-related vulnerabilities have been resolved.

much appreciated,

Omar