This ticket is to request backporting fix from JRASERVER-73593 into 8.20.x LTS version

XMLWordPrintable

    • Severity 2 - Major
    • 5.3
    • Medium

      Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers without permission to view a private project to view the project's issue creation meta information via a Broken Access Control vulnerability in the */issue/createmeta *endpoint.

      The affected LTS version is 8.20.8 and the fix is not backported to this version.

            Assignee:
            Konrad Plasota
            Reporter:
            skavatekar
            Votes:
            9 Vote for this issue
            Watchers:
            16 Start watching this issue

              Created:
              Updated:
              Resolved: