CVE-2019-20412

CWE-287 — Improper Authentication3 documents3 sources
Severity
5.3MEDIUM
EPSS
0.3%
top 45.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Atlassian Jira ServerAtlassian JiraAtlassian Jira Data Center+1 more
Timeline
PublishedJun 29
Latest updateMay 24

Description

The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information via an Improper Authentication vulnerability: Workflow names; Project Key, if it is part of the workflow name; Issue Keys; Issue Types; Status Types. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages5 packages

▶NVDatlassian/jira_data_center8.0.0 — 8.4.2
▶CVEListV5atlassian/jira_serverunspecified — 7.13.9+2
▶NVDatlassian/jira_server8.0.0 — 8.4.2
▶NVDatlassian/jira< 7.13.9

🔴Vulnerability Details

2
GHSA
GHSA-4r95-5hvx-m4wp: The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following inf↗2022-05-24
▶
CVEList
CVE-2019-20412: The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following inf↗2020-06-29
▶
CVE-2019-20412 (MEDIUM CVSS 5.3) | The Convert Sub-Task to Issue page | cvebase.io