CVE-2020-14183 — Sensitive Information Exposure in Atlassian Jira Server

CWE-200 — Sensitive Information Exposure3 documents3 sources

Severity

4.3MEDIUMNVD

EPSS

0.3%

top 45.59%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Atlassian Jira Server Atlassian Jira

Timeline

PublishedOct 6

Latest updateMay 24

Description

Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance's Support Entitlement Number (SEN) via an Information Disclosure vulnerability in the HTTP Response headers. The affected versions are before version 7.13.18, from version 8.0.0 before 8.5.9, and from version 8.6.0 before 8.12.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5atlassian/jira_serverunspecified — 7.13.18+4

▶NVDatlassian/jira8.0.0 — 8.5.9+2

🔴Vulnerability Details

GHSA

GHSA-c7mj-gq36-7x33: Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance's Support Entitleme↗2022-05-24

▶

CVEList

CVE-2020-14183: Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance's Support Entitleme↗2020-10-06

▶