Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-70569

Improper authorization on project titles vulnerability in Jira - CVE-2019-20404

XMLWordPrintable

      The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper authorization vulnerability.

      Note on fix

      • The fix was tested internally before backporting it and no issues were detected.
      • However, the fix changes the behavior of the REST API, therefore as a stability precaution we introduced a feature flag that disables the fix. In case of any problems with the new behavior enable the com.atlassian.jira.projectvalidate.anonymous feature flag (feature flag documentation for reference).

            [JRASERVER-70569] Improper authorization on project titles vulnerability in Jira - CVE-2019-20404

            Andriy Yakovlev [Atlassian] made changes -
            Remote Link New: This issue links to "JSEC-324 (Bulldog)" [ 568316 ]
            set-jac-bot made changes -
            Fixed in Long Term Support Release/s New: [Download 8.5|https://confluence.atlassian.com/enterprise/atlassian-enterprise-releases-948227420.html]
            Andriy Yakovlev [Atlassian] made changes -
            Description Original: The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper authorization vulnerability. New: The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper authorization vulnerability.

            h3. Note on fix
            * The fix was tested internally before backporting it and no issues were detected. (/)
            * However, the fix changes the behavior of the REST API, therefore as a stability precaution we introduced a feature flag that disables the fix. (i) In case of any problems with the new behavior enable the {{com.atlassian.jira.projectvalidate.anonymous}} feature flag ([feature flag documentation for reference|https://confluence.atlassian.com/jirakb/enable-dark-feature-in-jira-959286331.html]).
            Pawel Cegla made changes -
            Fix Version/s New: 8.5.11 [ 93490 ]
            Andriy Yakovlev [Atlassian] made changes -
            Labels Original: advisory advisory-released basm bugbash2 cve-2019-20404 cvss-medium security New: advisory advisory-released basm bugbash2 cve-2019-20404 cvss-medium lts-backport security
            Mark Lang made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 509300 ]
            Mark Lang made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 500269 ]
            Rene C. [Atlassian Support] made changes -
            Link New: This issue relates to JRASERVER-70520 [ JRASERVER-70520 ]
            Erin Jensby made changes -
            Security Original: Atlassian Staff [ 10750 ]
            Erin Jensby made changes -
            Labels Original: advisory advisory-to-release basm bugbash2 cve-2019-20404 cvss-medium security New: advisory advisory-released basm bugbash2 cve-2019-20404 cvss-medium security

              Unassigned Unassigned
              security-metrics-bot Security Metrics Bot
              Affected customers:
              0 This affects my team
              Watchers:
              15 Start watching this issue

                Created:
                Updated:
                Resolved: