-
Bug
-
Resolution: Fixed
-
Low (View bug fix roadmap)
-
8.3.0, 7.13.5
-
7.13
-
Severity 3 - Minor
-
The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information via an Improper Authentication vulnerability:
- Workflow names
- Project Key, if it is part of the workflow name
- Issue Keys
- Issue Types
- Status Types
Affected versions:
- version < 7.13.9
- 7.14.0 ≤ version < 8.4.2
Fixed versions:
- 7.13.9
- 8.4.2
- 8.5.0
This is an independent assessment and you should evaluate its applicability to your own IT environment.
CVSS v3 score: 7.2 => High severity
Exploitability Metrics
Scope Metric
Impact Metrics
https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N