vulnerability
Atlassian JIRA: Missing Authorization (CVE-2019-15013)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 4 | (AV:N/AC:L/Au:S/C:N/I:P/A:N) | Dec 18, 2019 | Dec 27, 2019 | Aug 11, 2025 |
Severity
4
CVSS
(AV:N/AC:L/Au:S/C:N/I:P/A:N)
Published
Dec 18, 2019
Added
Dec 27, 2019
Modified
Aug 11, 2025
Description
The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8.5.2 allows authenticated remote attackers who do not have project administration access to remove a configured issue status from a project via a missing authorisation check.
Solutions
atlassian-jira-upgrade-7_13_12atlassian-jira-upgrade-8_4_3atlassian-jira-upgrade-8_5_2
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.