CVE-2020-14185 — Missing Authorization in Atlassian Jira Server

CWE-862 — Missing Authorization CWE-200 — Sensitive Information Exposure3 documents3 sources

Severity

5.3MEDIUMNVD

EPSS

0.3%

top 48.63%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Atlassian Jira Server Atlassian Jira

Timeline

PublishedOct 15

Latest updateMay 24

Description

Affected versions of Jira Server allow remote unauthenticated attackers to enumerate issue keys via a missing permissions check in the ActionsAndOperations resource. The affected versions are before 7.13.18, from version 8.0.0 before 8.5.9, and from version 8.6.0 before version 8.12.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5atlassian/jira_serverunspecified — 7.13.18+3

▶NVDatlassian/jira_server8.0.0 — 8.5.9+1

▶NVDatlassian/jira< 7.13.18

🔴Vulnerability Details

GHSA

GHSA-xpwh-g564-whc7: Affected versions of Jira Server allow remote unauthenticated attackers to enumerate issue keys via a missing permissions check in the ActionsAndOpera↗2022-05-24

▶

CVEList

CVE-2020-14185: Affected versions of Jira Server allow remote unauthenticated attackers to enumerate issue keys via a missing permissions check in the ActionsAndOpera↗2020-10-15

▶