CVE-2019-14995
published 2019-09-11CVE-2019-14995: The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and…
PriorityP432medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
3.01%
85.9th percentile
The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is valid via a missing permissions check.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| atlassian | jira | >= unspecified < 8.4.0 | 8.4.0 |
| atlassian | jira_server | >= 7.6.0 < 8.4.0 | 8.4.0 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Talos
Vulnerability Spotlight: Multiple vulnerabilities in Atlassian Jira
blogs_talos·2019-09-16·CVSS 6.5
[MEDIUM] Vulnerability Spotlight: Multiple vulnerabilities in Atlassian Jira
Ben Taylor of Cisco ASIG discovered these vulnerabilities.
Atlassian’s Jira software contains multiple vulnerabilities that could allow an attacker to carry out a variety of actions, including the disclosure of sensitive information and the remote execution of JavaScript code. Jira is a piece of software that allows users to create, manage and organize tasks and
manage projects. These bugs could create a variety of scenarios, including the ability to execute code inside of Jira and the disclosure of information inside of tasks created in Jira, including the attached documents.
In accordance with our coordinated disclosure policy, Cisco Talos worked with Atlassian to ensure that these issues are resolved and that an update is available for affected customers.
### Vulnerability detailsAt
Talos
Vulnerability Spotlight: Multiple vulnerabilities in Atlassian Jira
blogs_talos·2019-09-16·CVSS 6.5
[MEDIUM] Vulnerability Spotlight: Multiple vulnerabilities in Atlassian Jira
## Vulnerability Spotlight: Multiple vulnerabilities in Atlassian Jira
Ben Taylor of Cisco ASIG discovered these vulnerabilities.
Atlassian’s Jira software contains multiple vulnerabilities that could allow an attacker to carry out a variety of actions, including the disclosure of sensitive information and the remote execution of JavaScript code. Jira is a piece of software that allows users to create, manage and organize tasks and
manage projects. These bugs could create a variety of scenarios, including the ability to execute code inside of Jira and the disclosure of information inside of tasks created in Jira, including the attached documents.
In accordance with our coordinated disclosure policy, Cisco Talos worked with Atlassian to ensure that these issues are resolved and that an
https://jira.atlassian.com/browse/JRASERVER-69792https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0836https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0837https://jira.atlassian.com/browse/JRASERVER-69792https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0836https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0837
2019-09-11
Published