[JRASERVER-72000] Project enumeration via Jira Projects plugin report page - CVE-2020-29451 - Create and track feature requests for Atlassian products.

XML

Word

Printable

Details

Type: Public Security Vulnerability
Status: Published (View Workflow)
Priority: Low
Resolution: Fixed
Affects Version/s: 8.5.8, 8.12.1, 8.13.0
Fix Version/s: 8.5.11, 8.13.3, 8.14.1, 8.15.0
Component/s: None
Labels:

CVSS Score:
4.3
CVSS Severity:
Medium
CVE ID:
CVE-2020-29451

Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure vulnerability in the Jira Projects plugin report page.

The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.14.1.

Affected versions:

version < 8.5.11
8.6.0 ≤ version < 8.13.3
8.14.0 ≤ version < 8.14.1

Fixed versions:

8.5.11
8.13.3
8.14.1
8.15.0

Attachments

Issue Links

relates to: VULN-208175 Loading...

Activity

People

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 19/Jan/2021 10:18 PM

Updated:: 16/Sep/2021 5:28 AM

Resolved:: 03/Feb/2021 11:06 PM