• Type: Public Security Vulnerability
• Resolution: Fixed
• Priority: Low (View bug fix roadmap)
• Fix Version/s: 8.13.1, 8.5.10
• Affects Version/s: 8.13.0
• Component/s: None
• Labels:

  • CVE-2021-39127
  • advisory
  • advisory-to-release
  • dont-import
  • security

[JRASERVER-72003] Anonymous User is Able to Access Query Component JQL Endpoint - CVE-2021-39127

Security Metrics Bot made changes - 24/Oct/2021 8:28 PM

CVE ID

New: CVE-2021-39127

AB made changes - 21/Oct/2021 2:35 AM

Resolution		New: Fixed [ 1 ]
Security	Original: Atlassian Staff [ 10750 ]
Status	Original: Draft [ 12872 ]	New: Published [ 12873 ]

AB made changes - 21/Oct/2021 2:34 AM

Labels

Original: advisory advisory-to-release dont-import security

New: CVE-2021-39127 advisory advisory-to-release dont-import security

AB made changes - 21/Oct/2021 2:34 AM

Summary

Original: Anonymous User is Able to Access Query Component JQL Endpoint - CVE registration for this issue is in progress

New: Anonymous User is Able to Access Query Component JQL Endpoint - CVE-2021-39127

AB made changes - 14/Sep/2021 5:26 AM

Summary

Original: Anonymous User is Able to Access Query Component JQL Endpoint

New: Anonymous User is Able to Access Query Component JQL Endpoint - CVE registration for this issue is in progress

AB made changes - 14/Sep/2021 5:25 AM

Summary

Original: Privilege escalation: Anonymous User is Able to Access Query Component JQL Endpoint

New: Anonymous User is Able to Access Query Component JQL Endpoint

AB made changes - 14/Sep/2021 5:24 AM

Description

Original: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a Broken Access Control vulnerability (BAC) vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1.  *Affected versions:*  *  version < 8.5.10  * 8.6.0 ≤ version < 8.13.1   *Fixed versions:*  * 8.13.1  * 8.5.10

New: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a Broken Access Control vulnerability (BAC) vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1.  *Affected versions:*  * version < 8.5.10  * 8.6.0 ≤ version < 8.13.1   *Fixed versions:*  * 8.13.1  * 8.5.10

AB made changes - 14/Sep/2021 5:12 AM

Description

Original: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access SLAs for private projects for which they do not have view permissions via a Broken Access Control vulnerability (BAC) vulnerability.   The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1.   *Affected versions:*  *  version < 8.5.10  * 8.6.0 ≤ version < 8.13.1   *Fixed versions:*  * 8.13.1  * 8.5.10

New: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a Broken Access Control vulnerability (BAC) vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1.  *Affected versions:*  *  version < 8.5.10  * 8.6.0 ≤ version < 8.13.1   *Fixed versions:*  * 8.13.1  * 8.5.10

AB made changes - 14/Sep/2021 5:11 AM

Summary

Original: Privilege escalation:- Unauth User is Able to Access Query Component JQL Endpoint

New: Privilege escalation: Anonymous User is Able to Access Query Component JQL Endpoint

Colin Xu made changes - 21/Jan/2021 1:51 AM

Description

Original: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access SLAs for private projects for which they do not have view permissions via a Broken Access Control vulnerability (BAC) vulnerability.   The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1.   *Affected versions:*  *  version < 8.5.10  * 8.6.0 ≤ version < 8.13.1   *Fixed versions:*  * 8.13.1  * 8.5.10 CVSSSLAOlderView ×

New: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access SLAs for private projects for which they do not have view permissions via a Broken Access Control vulnerability (BAC) vulnerability.   The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1.   *Affected versions:*  *  version < 8.5.10  * 8.6.0 ≤ version < 8.13.1   *Fixed versions:*  * 8.13.1  * 8.5.10

Load more older events