Skip to content
CVE Tracker
Back

CVE-2019-20105

The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12,…

Medium4.9EPSS 1.5%
Published
Updated
Reserved
Assigned by
atlassian

Description

The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.1, and from version 7.1.0 before version 7.1.3 allows remote attackers who have obtained access to administrator's session to access the EditApplinkServlet resource without needing to re-authenticate to pass "WebSudo" in products that support "WebSudo" through an improper access control vulnerability.

Scores

CVSS scores of CVE-2019-20105, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.1Medium4.9CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
EPSS (exploitation in 30 days)
1.5% · top 26% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.9.

Weakness

Affected products

  • Atlassian · Application Links

    • affected unspecified – < 5.4.20
    • affected 6.0.0 – < unspecified
    • affected unspecified – < 6.0.12
    • affected 7.0.0 – < unspecified
    • affected unspecified – < 7.0.1
    • affected 7.1.0 – < unspecified
    • affected unspecified – < 7.1.3

  • Atlassian · Jira Server and Data Center

    • affected 7.13.8 – < unspecified
    • affected unspecified – < 7.13.12
    • affected 8.4.2 – < unspecified
    • affected unspecified – < 8.5.4
    • affected 8.6.0 – < unspecified
    • affected unspecified – < 8.6.1

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .