• Type: Public Security Vulnerability
• Resolution: Fixed
• Priority: Low (View bug fix roadmap)
• Fix Version/s: 8.13.2, 8.14.1, 8.15.0
• Affects Version/s: 8.9.0
• Component/s: None
• Labels:

  • cve-2020-36235

[JRASERVER-71950] Mobile site reveals the summary titles of privately linked tickets - CVE-2020-36235

Security Metrics Bot made changes - 16/Sep/2021 5:28 AM

CVE ID

New: CVE-2020-36235

AB made changes - 14/Feb/2021 11:42 PM

Security

Original: Reporter and Atlassian Staff [ 10751 ]

AB made changes - 14/Feb/2021 11:42 PM

Labels

New: cve-2020-36235

AB made changes - 14/Feb/2021 11:42 PM

Summary

Original: Mobile site reveals the summary titles of privately linked tickets - CVE-PENDING

New: Mobile site reveals the summary titles of privately linked tickets - CVE-2020-36235

David Black made changes - 04/Feb/2021 2:13 AM

Security

New: Reporter and Atlassian Staff [ 10751 ]

AB made changes - 03/Feb/2021 11:03 PM

Security

Original: Atlassian Staff [ 10750 ]

Collapse comment: AB added a comment - 03/Feb/2021 11:02 PM

AB added a comment - 03/Feb/2021 11:02 PM

This is an independent assessment and you should evaluate its applicability to your own IT environment.

CVSS v3 score: 5.3 => Medium severity

Exploitability Metrics

Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	None

Scope Metric

Scope	Unchanged

Impact Metrics

Confidentiality	Low
Integrity	None
Availability	None

https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

 

Expand comment: AB added a comment - 03/Feb/2021 11:02 PM

AB added a comment - 03/Feb/2021 11:02 PM This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 5.3 => Medium severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required None User Interaction None Scope Metric Scope Unchanged Impact Metrics Confidentiality Low Integrity None Availability None https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N  

AB made changes - 03/Feb/2021 11:02 PM

Resolution		New: Fixed [ 1 ]
Status	Original: Draft [ 12872 ]	New: Published [ 12873 ]

AB made changes - 03/Feb/2021 11:01 PM

Summary

Original: Mobile site reveals the summary titles of privately linked tickets

New: Mobile site reveals the summary titles of privately linked tickets - CVE-PENDING

AB made changes - 03/Feb/2021 11:01 PM

Description

Original: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in the custom field and custom SLA names.   The affected versions are before version 8.13.2, and from version 8.14.0 before 8.14.1.   *Affected versions:*  * version < 8.13.2  * 8.14.0 ≤ version < 8.14.1 *Fixed versions:*  * 8.13.2  * 8.14.1  * 8.15.0

New: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names via an Information Disclosure vulnerability in the mobile site view.   The affected versions are before version 8.13.2, and from version 8.14.0 before 8.14.1.   *Affected versions:*  * version < 8.13.2  * 8.14.0 ≤ version < 8.14.1 *Fixed versions:*  * 8.13.2  * 8.14.1  * 8.15.0

Load more older events