CVE-2019-12836 - The Bobronix JEditor editor before 3.0.6 for Jira allows an attacker to add a URL/Link (to an existing issue) that can cause forgery of a request to an out-of-origin domain

Back Back to CVE browser

HIGH

The Bobronix JEditor editor before 3.0.6 for Jira allows an attacker to add a URL/Link (to an existing issue) that can cause forgery of a request to an out-of-origin domain

Published Jun 21, 2019

8.8

HIGH

CVSS 3.0

EPSS 0.97%

Description

The Bobronix JEditor editor before 3.0.6 for Jira allows an attacker to add a URL/Link (to an existing issue) that can cause forgery of a request to an out-of-origin domain. This in turn may allow for a forged request that can be invoked in the context of an authenticated user, leading to stealing of session tokens and account takeover.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4416
Advisory
https://github.com/9lyph/CVE-2019-12836/blob/master/README.md
x_refsource_MISCExploitThird Party Advisory
https://jeditor.zendesk.com/hc/en-us/articles/360029430751-JEditor-3-0-6-release-notes
x_refsource_CONFIRMRelease NotesThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4416		Advisory
https://github.com/9lyph/CVE-2019-12836/blob/master/README.md		x_refsource_MISCExploitThird Party Advisory
https://jeditor.zendesk.com/hc/en-us/articles/360029430751-JEditor-3-0-6-release-notes		x_refsource_CONFIRMRelease NotesThird Party Advisory