CVE-2019-20401

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being installed, via Cross-site request forgery (CSRF) vulnerabilities.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Feb 6, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-204024.9Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without rCVE-2019-204035.3The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or nCVE-2019-204044.3The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles theyCVE-2019-204054.3The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flaCVE-2019-204067.8The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.CVE-2019-204074.3The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackerCVE-2019-204085.3The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal netCVE-2019-204099.8The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gaCVE-2019-20417.3In the configuration of NFC modules on certain devices, there is a possible failure to distinguish individual devices due to an insecure defCVE-2019-204106.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information DisclosurCVE-2019-204114.3Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgCVE-2019-204125.3The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the fol
CVE-2019-20401: Medium severity, CVSS 6.5 | Vulnix