Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2020-14179 — Sensitive Information Exposure in Atlassian Jira Server

CWE-200 — Sensitive Information Exposure15 documents5 sources
Severity
5.3MEDIUMNVD
EPSS
92.6%
top 0.26%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Atlassian Jira ServerAtlassian Jira Data Center
Timeline
PublishedSep 21
Latest updateDec 18

Description

Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from version 8.6.0 before 8.11.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶NVDatlassian/jira_data_center8.6.0 — 8.11.1+1
▶CVEListV5atlassian/jira_serverunspecified — 8.5.8+2
▶NVDatlassian/jira_server8.6.0 — 8.11.1+1

🔴Vulnerability Details

2
GHSA
GHSA-25wr-cfxr-69vm: Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via↗2022-05-24
▶
CVEList
CVE-2020-14179: Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via↗2020-09-21
▶

💥Exploits & PoCs

1
Nuclei
Atlassian Jira Server/Data Center <8.5.8/8.6.0 - 8.11.1 - Information Disclosure
▶

💬Community

10
HackerOne
Sensitive data exposure via /secure/███████ endpoint on ████████↗2024-12-18
▶
HackerOne
[U.S. Air Force] Information disclosure due unauthenticated access to APIs and system browser functions↗2023-01-27
▶
HackerOne
Sensitive data exposure via /secure/QueryComponent!Default.jspa endpoint on ████████↗2022-04-29
▶
HackerOne
Information disclosure at '████████' --- CVE-2020-14179↗2021-09-29
▶
HackerOne
Sensitive data exposure via https://███████/jira//secure/QueryComponent!Default.jspa - CVE-2020-14179↗2021-09-09
▶
CVE-2020-14179 — Sensitive Information Exposure | cvebase