Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance which has not yet finished being installed via Cross-site request forgery (CSRF) vulnerabilities.