• Type: Public Security Vulnerability
• Resolution: Fixed
• Priority: Low
• Fix Version/s: 4.21.0, 4.20.4
• Affects Version/s: 4.20.0
• Component/s: None
• Labels:

  • advisory
  • advisory-released
  • dont-import
  • security

[JSDSERVER-10982] An unauthorized user can view private objects via the Custom Fields feature - CVE-2021-43949

David Black made changes - 04/Feb/2022 5:14 AM

Labels

Original: advisory advisory-to-release dont-import security

New: advisory advisory-released dont-import security

David Chan made changes - 20/Jan/2022 10:05 PM

Fix Version/s

New: 4.20.4 [ 98814 ]

Security Metrics Bot made changes - 16/Jan/2022 8:28 PM

CVE ID

New: CVE-2021-43949

AB made changes - 10/Jan/2022 6:24 AM

Security

Original: Atlassian Staff [ 10750 ]

AB made changes - 10/Jan/2022 6:24 AM

Resolution		New: Fixed [ 1 ]
Status	Original: Draft [ 12872 ]	New: Published [ 12873 ]

AB made changes - 10/Jan/2022 6:23 AM

Summary

Original: An unauthorized user can view private objects via the Custom Fields feature - CVE registration for this issue is already in progress

New: An unauthorized user can view private objects via the Custom Fields feature - CVE-2021-43949

AB made changes - 06/Jan/2022 1:14 AM

Summary

Original: An unauthorized user can view private objects via the Custom Fields feature

New: An unauthorized user can view private objects via the Custom Fields feature - CVE registration for this issue is already in progress

AB made changes - 06/Jan/2022 1:13 AM

Description

Original: This vulnerability affects certain versions of Atlassian Jira Service Management Server. Please describe the impact of the vulnerability here. No known vulnerability could be read off of the parent.

New: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects via a Broken Access Control vulnerability in the Custom Fields feature. The affected versions are before version 4.21.0. *Affected versions:*  * version < 4.21.0 *Fixed versions:*  * 4.21.0

AB made changes - 06/Jan/2022 1:13 AM

Summary

Original: REST API Endpoint Leaked private object by [Custom Fields] to unauthorized user

New: An unauthorized user can view private objects via the Custom Fields feature

Security Metrics Bot made changes - 22/Dec/2021 3:14 AM

Labels

New: advisory advisory-to-release dont-import security

Security Metrics Bot created issue - 22/Dec/2021 3:14 AM