CVE-2019-20098

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to enumerate hosts and open ports on the internal network where Jira server is present.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Atlassian	Jira Server	>= unspecified, < 8.7.0

References

https://jira.atlassian.com/browse/JRASERVER-70605Issue Tracking, Vendor Advisory
https://www.tenable.com/security/research/tra-2020-05Exploit, Third Party Advisory
https://jira.atlassian.com/browse/JRASERVER-70605Issue Tracking, Vendor Advisory
https://www.tenable.com/security/research/tra-2020-05Exploit, Third Party Advisory

Timeline

Published: Feb 12, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-200994.3The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site r CVE-2019-20107.8In phNxpNciHal_process_ext_rsp of phNxpNciHal_ext.cc, there is a possible out-of-bound write due to a missing bounds check. This could lead CVE-2019-201004.7The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF). The following versions are affected: all versions CVE-2019-201015.3Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view whitelist rules via a Broken Access Cont CVE-2019-201026.1The attachment-uploading feature in Atlassian Confluence Server from version 6.14.0 through version 6.14.3, and version 6.15.0 before versio CVE-2019-201047.5The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perfor CVE-2019-201054.9The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, f CVE-2019-201064.3Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before versio CVE-2019-201078.8Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via th CVE-2019-20117.8In readNullableNativeHandleNoDup of Parcel.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to lo CVE-2019-20128.8In rw_t3t_act_handle_fmt_rsp of rw_t3t.cc, there is a possible out-of-bound write due to a missing bounds check. This could lead to local es CVE-2019-20138.8In rw_t3t_act_handle_sro_rsp of rw_t3t.cc, there is a possible out-of-bound write due to a missing bounds check. This could lead to local es