[JRASERVER-69246] Information disclosure in the BrowseProjects.jspa resource - CVE-2019-3399 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Low (View bug fix roadmap)
Fix Version/s: 8.1.0, 7.13.2, 8.0.2
Affects Version/s: 7.12.0, 7.13.0, 7.13.1
Component/s: Data Center - Archiving, Project - Actions
Labels:

Fixed in Long Term Support Release/s:

Download 7.13
Introduced in Version:
7.12
Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for archived projects through a missing authorisation check.

mentioned in: Page Loading...

Loading...

Type: Bug
Resolution: Fixed
Priority: Low
Fix Version/s: 8.1.0, 7.13.2, 8.0.2
Affects Version/s: 7.12.0, 7.13.0, 7.13.1
Component/s: Data Center - Archiving, Project - Actions
Labels:

Fixed in Long Term Support Release/s:

Download 7.13
Introduced in Version:
7.12
Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for archived projects through a missing authorisation check.

mentioned in: Page Loading...

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Votes:: 0 Vote for this issue

Watchers:: 6 Start watching this issue

Created:: 29/Apr/2019 4:15 AM

Updated:: 22/May/2020 8:26 AM

Resolved:: 29/Apr/2019 4:19 AM

Details

Description

Attachments

Issue Links

Forms

Activity