VULNERABILITY INTELLIGENCE

CVE-2018-13400

CVSS score4.7 MEDIUM

EPSS probability1.44%

CISA KEVNot currently listed

Published2018-10-23

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Description

Several administrative resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allow remote attackers who have obtained access to administrator's session to access certain administrative resources without needing to re-authenticate to pass "WebSudo" through an improper access control vulnerability.

Weakness classification

CWE-269: Improper Privilege Management

Primary references

security@atlassian.com — Third Party Advisory, VDB Entry
security@atlassian.com — Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory