CVE-2019-15011

EUVD-2019-6098
The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3.7, from version 5.4.0 before 5.4.13, and from version 6.0.0 before 6.0.5 disclosed application link information to non-admin users via a missing permissions check.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 38%
Affected Products (NVD)
VendorProductVersion
atlassianapplication_links
𝑥
< 5.0.12
atlassianapplication_links
5.1.0 ≤
𝑥
< 5.2.11
atlassianapplication_links
5.3.0 ≤
𝑥
< 5.3.7
atlassianapplication_links
5.4.0 ≤
𝑥
< 5.4.13
atlassianapplication_links
6.0.0 ≤
𝑥
< 6.0.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://ecosystem.atlassian.net/browse/APL-1386
https://ecosystem.atlassian.net/browse/APL-1386