CVE-2018-13401
Status: ModifiedMedium (6.1)—
The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allows remote attackers to obtain a user's Cross-site request forgery (CSRF) token through an open redirect vulnerability.
CVSS
- Version: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Base score: 6.1
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 1.36%
- Percentile among all scored CVEs: 71
- Score date: 10/7/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (2)
CWEs
- CWE-601
References
Raw JSON (NVD)
Show
{
"id": "CVE-2018-13401",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5.8,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 4.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.0",
"baseScore": 6.1,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "security@atlassian.com",
"affectedData": [
{
"vendor": "Atlassian",
"product": "Jira",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.6.9",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.7.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.7.5",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.8.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.8.5",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.9.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.9.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.10.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.10.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.11.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.11.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.12.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.12.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.13.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.13.1",
"versionType": "custom"
}
]
}
]
}
],
"published": "2018-10-23T13:29:03.040",
"references": [
{
"url": "http://www.securityfocus.com/bid/105751",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "security@atlassian.com"
},
{
"url": "https://jira.atlassian.com/browse/JRASERVER-68139",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"source": "security@atlassian.com"
},
{
"url": "http://www.securityfocus.com/bid/105751",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://jira.atlassian.com/browse/JRASERVER-68139",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-601"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allows remote attackers to obtain a user's Cross-site request forgery (CSRF) token through an open redirect vulnerability."
},
{
"lang": "es",
"value": "El recurso XsrfErrorAction en Atlassian Jira en versiones anteriores a la 7.6.9, desde la versión 7.7.0 anterior a la 7.7.5, desde la versión 7.8.0 anterior a la 7.8.5, desde la versión 7.9.0 anterior a la 7.9.3, desde la versión 7.10.0 anterior a la 7.10.3, desde la versión 7.11.0 anterior a la 7.11.3, desde la versión 7.12.0 anterior a la 7.12.3 y antes de la versión 7.13.1 permite que atacantes remotos obtengan el token Cross-Site Request Forgery (CSRF) de un usuario a través de una vulnerabilidad de redirección abierta."
}
],
"lastModified": "2026-06-17T01:39:20.883",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "25E9DDE1-F33F-4F65-A521-807D4F09C0AE",
"versionEndExcluding": "7.6.9"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "300D871F-7128-41F1-BCC8-BE7C3687741B",
"versionEndExcluding": "7.7.5",
"versionStartIncluding": "7.7.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A04E4050-271E-4D23-B988-E02D5A651386",
"versionEndExcluding": "7.8.5",
"versionStartIncluding": "7.8.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2A3C3F9E-5BDD-48F3-B45F-9B9C6D31CAE2",
"versionEndExcluding": "7.9.3",
"versionStartIncluding": "7.9.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C568973F-5079-49ED-928D-7F11C842CF4B",
"versionEndExcluding": "7.10.3",
"versionStartIncluding": "7.10.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "551A5667-1184-4E3D-9AA7-90C8D18590C3",
"versionEndExcluding": "7.11.3",
"versionStartIncluding": "7.11.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "078CC169-BA97-4F89-A9AE-05E21FC867CA",
"versionEndExcluding": "7.12.3",
"versionStartIncluding": "7.12.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C0A81285-A452-4AFE-94BE-3B27014535A3",
"versionEndExcluding": "7.13.1",
"versionStartIncluding": "7.13.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security@atlassian.com"
}