CVE-2018-13400
Estado: ModificadaMedia (4.7)—
Several administrative resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allow remote attackers who have obtained access to administrator's session to access certain administrative resources without needing to re-authenticate to pass "WebSudo" through an improper access control vulnerability.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
- Puntuación base: 4.7
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.44%
- Percentil entre todas las CVEs puntuadas: 72
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-269
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2018-13400",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"authentication": "SINGLE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 4.7,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "HIGH",
"confidentialityImpact": "LOW"
},
"impactScore": 3.4,
"exploitabilityScore": 1.2
}
]
},
"affected": [
{
"source": "security@atlassian.com",
"affectedData": [
{
"vendor": "Atlassian",
"product": "Jira",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.6.9",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.7.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.7.5",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.8.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.8.5",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.9.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.9.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.10.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.10.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.11.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.11.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.12.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.12.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.13.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.13.1",
"versionType": "custom"
}
]
}
]
}
],
"published": "2018-10-23T13:29:02.947",
"references": [
{
"url": "http://www.securityfocus.com/bid/105751",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "security@atlassian.com"
},
{
"url": "https://jira.atlassian.com/browse/JRASERVER-68138",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"source": "security@atlassian.com"
},
{
"url": "http://www.securityfocus.com/bid/105751",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://jira.atlassian.com/browse/JRASERVER-68138",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-269"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Several administrative resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allow remote attackers who have obtained access to administrator's session to access certain administrative resources without needing to re-authenticate to pass \"WebSudo\" through an improper access control vulnerability."
},
{
"lang": "es",
"value": "Varios recursos administrativos en Atlassian Jira en versiones anteriores a la 7.6.9, desde la versión 7.7.0 anterior a la 7.7.5, desde la versión 7.8.0 anterior a la 7.8.5, desde la versión 7.9.0 anterior a la 7.9.3, desde la versión 7.10.0 anterior a la 7.10.3, desde la versión 7.11.0 anterior a la 7.11.3, desde la versión 7.12.0 anterior a la 7.12.3 y antes de la versión 7.13.1 permiten que atacantes remotos con acceso a la sesión de administrador accedan a ciertos recursos administrativos sin necesitar reautenticarse para pasar \"WebSudo\" a través de una vulnerabilidad de control de acceso incorrecto."
}
],
"lastModified": "2026-06-17T01:39:20.747",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "25E9DDE1-F33F-4F65-A521-807D4F09C0AE",
"versionEndExcluding": "7.6.9"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "300D871F-7128-41F1-BCC8-BE7C3687741B",
"versionEndExcluding": "7.7.5",
"versionStartIncluding": "7.7.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A04E4050-271E-4D23-B988-E02D5A651386",
"versionEndExcluding": "7.8.5",
"versionStartIncluding": "7.8.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2A3C3F9E-5BDD-48F3-B45F-9B9C6D31CAE2",
"versionEndExcluding": "7.9.3",
"versionStartIncluding": "7.9.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C568973F-5079-49ED-928D-7F11C842CF4B",
"versionEndExcluding": "7.10.3",
"versionStartIncluding": "7.10.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "551A5667-1184-4E3D-9AA7-90C8D18590C3",
"versionEndExcluding": "7.11.3",
"versionStartIncluding": "7.11.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "078CC169-BA97-4F89-A9AE-05E21FC867CA",
"versionEndExcluding": "7.12.3",
"versionStartIncluding": "7.12.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C0A81285-A452-4AFE-94BE-3B27014535A3",
"versionEndExcluding": "7.13.1",
"versionStartIncluding": "7.13.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security@atlassian.com"
}