CVE-2019-8445: atlassian jira Incorrect Authorization
Vulnerability summary
CVE-2019-8445 is a medium (CVSS 5.3) Incorrect Authorization vulnerability in atlassian jira. EPSS estimates a 2.71% chance of exploitation in the next 30 days, higher than 86% of scored vulnerabilities.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 23-08-2019PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote attackers to view worklog time information via a missing permissions check.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.71%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.71% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Atlassian2 products
- jira≥ unspecified, < 7.13.7 | ≥ 8.0.0, < unspecified | ≥ unspecified, < 8.3.2
- jira_server≥ 7.13.0, < 7.13.7 | ≥ 8.0.0, < 8.3.2
1 vendor · 2 products