[JRASERVER-69246] Information disclosure in the BrowseProjects.jspa resource - CVE-2019-3399 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Low (View bug fix roadmap)
Fix Version/s: 8.1.0, 7.13.2, 8.0.2
Affects Version/s: 7.12.0, 7.13.0, 7.13.1
Component/s: Data Center - Archiving, Project - Actions
Labels:

Fixed in Long Term Support Release/s:

Download 7.13
Introduced in Version:
7.12
Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for archived projects through a missing authorisation check.

mentioned in: Page Failed to load

No work has yet been logged on this issue.

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Affected customers:: 0 This affects my team

Watchers:: 6 Start watching this issue

Created:: 29/Apr/2019 4:15 AM

Updated:: 22/May/2020 8:26 AM

Resolved:: 29/Apr/2019 4:19 AM

Jira Data Center

Details

Description

Attachments

Issue Links

Forms

Activity

[JRASERVER-69246] Information disclosure in the BrowseProjects.jspa resource - CVE-2019-3399

People

Dates