CVE-2020-29451

CWE-200 — Information Exposure3 documents3 sources

Severity

4.3MEDIUM

EPSS

0.2%

top 63.65%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Atlassian Jira Data Center Atlassian Jira Server Atlassian Data Center +1 more

Timeline

PublishedFeb 15

Latest updateMay 24

Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure vulnerability in the Jira Projects plugin report page. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.14.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages5 packages

▶CVEListV5atlassian/jira_data_centerunspecified — 8.5.11+4

▶CVEListV5atlassian/jira_serverunspecified — 8.5.11+4

▶NVDatlassian/jira_server8.6.0 — 8.13.3+1

▶NVDatlassian/jira< 8.5.11

▶NVDatlassian/data_center8.6.0 — 8.13.3+2

🔴Vulnerability Details

GHSA

GHSA-ggg2-jv3w-69vx: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure vulnerabili↗2022-05-24

▶

CVEList

CVE-2020-29451: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure vulnerabili↗2021-02-15

▶