{"id":"CVE-2019-15013","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-15013","generatedAt":"2026-10-29T02:05:00.996Z","title":"The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8.5.2 allows authenticated remote attackers who do not have project administration access to…","description":"The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8.5.2 allows authenticated remote attackers who do not have project administration access to remove a configured issue status from a project via a missing authorisation check.","published":"2019-12-18T04:15:14.000Z","lastModified":"2026-06-17T02:19:30.000Z","status":"Modified","sourceIdentifier":"security@atlassian.com","cvss":{"version":"3.1","score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},"cwe":["CWE-862"],"affected":["atlassian/jira","atlassian/jira server"],"epss":{"score":0.0121,"percentile":0.6828,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.21%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://jira.atlassian.com/browse/JRASERVER-70405","tags":["Vendor Advisory"],"source":"security@atlassian.com"},{"url":"https://jira.atlassian.com/browse/JRASERVER-70405","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-15013","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}