[JRASERVER-70565] Information disclosure of project key existence vulnerability in Jira - CVE-2019-20403 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Low (View bug fix roadmap)
Fix Version/s: 8.6.0, 8.5.5
Affects Version/s: 7.13.5, 8.2.4
Component/s: Jira Importers Plugin
Labels:

Fixed in Long Term Support Release/s:

Download 8.5
Introduced in Version:
7.13
Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an information disclosure vulnerability.

mentioned in: Page Failed to load; Page Failed to load

No work has yet been logged on this issue.

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Affected customers:: 0 This affects my team

Watchers:: 9 Start watching this issue

Created:: 29/Jan/2020 11:27 PM

Updated:: 18/Mar/2022 5:09 AM

Resolved:: 30/Jan/2020 9:29 PM

Details

Description

Attachments

Issue Links

Forms

Activity

[JRASERVER-70565] Information disclosure of project key existence vulnerability in Jira - CVE-2019-20403

People

Dates