Medium severity4.3NVD Advisory· Published Feb 12, 2020· Updated Jun 17, 2026

CVE-2019-20099

Description

The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to enumerate hosts and open ports on the internal network where Jira server is present.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Atlassian/Jira Data Center
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
Range: >=7.6.15,<8.5.4
Atlassian/Jira Server2 versions
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*range: >=7.6.15,<8.5.4
- (no CPE)range: unspecified
Atlassian/Crowd Data Center and Serverllm-fuzzy
Range: <8.7.0
Atlassian/Jirallm-fuzzy
Range: <8.7.0

Patches

Vulnerability mechanics

References

www.tenable.com/security/research/tra-2020-05nvdExploitThird Party Advisory
jira.atlassian.com/browse/JRASERVER-70606nvdIssue TrackingVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000