-
Bug
-
Resolution: Fixed
-
Low (View bug fix roadmap)
-
7.13.1, 8.7.0, 8.6.1, 8.5.4, 8.8.0, 8.7.1
-
7.13
-
Severity 2 - Major
-
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project names via an improper authorization vulnerability in the /rest/project-templates/1.0/createshared endpoint API endpoint.
Affected versions:
- version < 8.5.5
- 8.6.0 ≤ version < 8.7.2
- 8.8.0 ≤ version < 8.8.1
Fixed versions:
- 8.5.5
- 8.7.2
- 8.8.1
- 8.9.0
- relates to
-
VULN-616389 Failed to load
This is an independent assessment and you should evaluate its applicability to your own IT environment.
CVSS v3 score: 4.3 => Medium severity
Exploitability Metrics
Scope Metric
Impact Metrics
https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N