CVE-2020-14174

CWE-639 — Insecure Direct Object Reference CWE-20 — Improper Input Validation3 documents3 sources

Severity

4.3MEDIUM

EPSS

0.1%

top 66.00%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Atlassian Jira Server Atlassian Jira Atlassian Jira Data Center +1 more

Timeline

PublishedJul 13

Latest updateMay 24

Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, from version 8.6.0 before 8.9.2, and from version 8.10.0 before 8.10.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages5 packages

▶NVDatlassian/jira_data_center8.0.0 — 8.5.7+2

▶NVDatlassian/jira_software_data_center< 7.13.16

▶CVEListV5atlassian/jira_serverunspecified — 7.13.6+6

▶NVDatlassian/jira_server8.0.0 — 8.5.7+2

▶NVDatlassian/jira< 7.13.16

🔴Vulnerability Details

GHSA

GHSA-mj7m-2673-wpjr: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object Re↗2022-05-24

▶

CVEList

CVE-2020-14174: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object Re↗2020-07-13

▶