Security readout for executives and security teams
Plain-English summary
CVE-2019-15011 is an Atlassian Application Links information disclosure issue. A missing permission check allowed non-admin users to view application link information that should have required administrator access. The sources do not provide CVSS, exploitation evidence, or detailed business impact.
Executive priority
Treat as a targeted confidentiality risk for Atlassian-connected environments. Prioritize remediation where application links expose sensitive integration details or broad internal user populations can authenticate.
Technical view
The vulnerable component is the ListEntityLinksServlet resource in Atlassian Application Links. Affected ranges include versions before 5.0.12, 5.1.0 before 5.2.11, 5.3.0 before 5.3.7, 5.4.0 before 5.4.13, and 6.0.0 before 6.0.5.
Likely exposure
Exposure is likely limited to environments running Atlassian Application Links in the listed vulnerable ranges. The described attacker role is a non-admin user, so risk depends on internal account access and what application link information is sensitive.
Exploitation context
The provided sources do not show active exploitation, public exploit availability, or KEV listing. The vulnerability is described as improper disclosure through a missing permissions check, not remote code execution or privilege escalation.
Researcher notes
Evidence is narrow: version ranges and root cause are clear, but CVSS, CWE, exploitability details, and impact specifics are absent in the supplied bundle. Avoid assuming affected Atlassian products beyond Application Links.
Mitigation direction
- Upgrade Application Links to a fixed version outside the affected ranges.
- Check Atlassian issue APL-1386 for vendor-specific remediation guidance.
- Inventory Atlassian systems that include or depend on Application Links.
- Limit non-admin account access where operationally feasible until remediated.
Validation and detection
- Confirm deployed Application Links versions against the affected ranges.
- Verify fixed versions: 5.0.12, 5.2.11, 5.3.7, 5.4.13, or 6.0.5 or later.
- Review whether non-admin users have unnecessary access to linked application metadata.
- Document compensating controls if upgrade cannot be completed immediately.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-15011 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://ecosystem.atlassian.net/browse/APL-1386CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.