CVE-2019-14995 — Incorrect Authorization in Atlassian Jira

CWE-863 — Incorrect AuthorizationCWE-862 — Missing AuthorizationCWE-276 — Incorrect Default Permissions3 documents3 sources
Severity
5.3MEDIUMNVD
EPSS
0.5%
top 35.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Atlassian JiraAtlassian Jira Server
Timeline
PublishedSep 11
Latest updateMay 24

Description

The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is valid via a missing permissions check.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5atlassian/jiraunspecified — 8.4.0
▶NVDatlassian/jira_server7.6.0 — 8.4.0

🔴Vulnerability Details

2
GHSA
GHSA-qr6q-3xcr-gfvw: The /rest/api/1↗2022-05-24
▶
CVEList
CVE-2019-14995: The /rest/api/1↗2019-09-11
▶
CVE-2019-14995 — Incorrect Authorization in Atlassian | cvebase