Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-72064

Custom field options are exposed via an unauthenticated REST API endpoint - CVE-2020-36237

XMLWordPrintable

    • 5
    • Medium
    • CVE-2020-36237

      Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Information Disclosure vulnerability in the /rest/api/2/customFieldOption/ endpoint.

       

      The affected versions are before version 8.15.0.

       

      Affected versions:

      • version < 8.15.0

      Fixed versions:

      • 8.15.0  

            [JRASERVER-72064] Custom field options are exposed via an unauthenticated REST API endpoint - CVE-2020-36237

            Russell Berry added a comment -

            Qualys is flagging this issue as QID 150370.

             

            Russell Berry added a comment - Qualys is flagging this issue as QID 150370.  

            Ravi Dahal added a comment -

            Is this Fix available for LTS 8.13.x?

            Ravi Dahal added a comment - Is this Fix available for LTS 8.13.x?

            Fritz Meier added a comment -

            Any news about a fix in the Long Term Support Version

            Fritz Meier added a comment - Any news about a fix in the Long Term Support Version

            LPS Config Team added a comment -

            Why is this not fixed for 8.13.x?

            LPS Config Team added a comment - Why is this not fixed for 8.13.x?

            Russell Berry added a comment -

            More than three months and two updates of the Long Term Support release later and this is still not fixed.

            Russell Berry added a comment - More than three months and two updates of the Long Term Support release later and this is still not fixed.

            Emilio Palmiero added a comment -

            Will this be backported to 8.13.x?

            Emilio Palmiero added a comment - Will this be backported to 8.13.x?

            Gunasekaran Subramanian added a comment -

             Is there any fix version available at LTS for this issue?

            Gunasekaran Subramanian added a comment -  Is there any fix version available at LTS for this issue?

            AB added a comment -

            This is an independent assessment and you should evaluate its applicability to your own IT environment. 

            CVSS v3 score: 5.3 => Medium severity

            Exploitability Metrics

            Attack Vector Network
            Attack Complexity Low
            Privileges Required None
            User Interaction None

            Scope Metric

            Scope Unchanged

            Impact Metrics

            Confidentiality Low
            Integrity None
            Availability None

            AB added a comment - This is an independent assessment and you should evaluate its applicability to your own IT environment.  CVSS v3 score: 5.3 => Medium severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required None User Interaction None Scope Metric Scope Unchanged Impact Metrics Confidentiality Low Integrity None Availability None

              Unassigned Unassigned
              security-metrics-bot Security Metrics Bot
              Votes:
              0 Vote for this issue
              Watchers:
              19 Start watching this issue

                Created:
                Updated:
                Resolved: