CVE-2019-20106

published 2020-02-06

CVE-2019-20106: Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows…

medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C N I L A N

Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
atlassian	jira	< 7.13.12	7.13.12
atlassian	jira_data_center	—	—
atlassian	jira_data_center	>= 8.0.0 < 8.5.4	8.5.4
atlassian	jira_server	—	—
atlassian	jira_server	>= 8.0.0 < 8.5.4	8.5.4
atlassian	jira_server_and_data_center	>= 8.4.1 < unspecified	unspecified
atlassian	jira_server_and_data_center	>= 8.6.0 < unspecified	unspecified
atlassian	jira_server_and_data_center	>= unspecified < 7.13.12	7.13.12
atlassian	jira_server_and_data_center	>= unspecified < 8.5.4	8.5.4
atlassian	jira_server_and_data_center	>= unspecified < 8.6.1	8.6.1
atlassian	jira_software_data_center	< 7.13.12	7.13.12

CWE-276