Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project names via an improper authorization vulnerability in the /rest/project-templates/1.0/createshared endpoint API endpoint.

Affected versions:

• version < 8.5.5
• 8.6.0 ≤ version < 8.7.2
• 8.8.0 ≤ version < 8.8.1

Fixed versions:

• 8.5.5
• 8.7.2
• 8.8.1
• 8.9.0