• Type: Public Security Vulnerability
• Resolution: Fixed
• Priority: Low
• Fix Version/s: 4.21.0, 4.20.4
• Affects Version/s: 4.20.0
• Component/s: None
• Labels:

  • advisory
  • advisory-released
  • dont-import
  • security

[JSDSERVER-10982] An unauthorized user can view private objects via the Custom Fields feature - CVE-2021-43949

David Black made changes - 04/Feb/2022 5:14 AM

Labels

Original: advisory advisory-to-release dont-import security

New: advisory advisory-released dont-import security

David Chan made changes - 20/Jan/2022 10:05 PM

Fix Version/s

New: 4.20.4 [ 98814 ]

Security Metrics Bot made changes - 16/Jan/2022 8:28 PM

CVE ID

New: CVE-2021-43949

AB made changes - 10/Jan/2022 6:24 AM

Security

Original: Atlassian Staff [ 10750 ]

AB made changes - 10/Jan/2022 6:24 AM

Resolution		New: Fixed [ 1 ]
Status	Original: Draft [ 12872 ]	New: Published [ 12873 ]

AB made changes - 10/Jan/2022 6:23 AM

Summary

Original: An unauthorized user can view private objects via the Custom Fields feature - CVE registration for this issue is already in progress

New: An unauthorized user can view private objects via the Custom Fields feature - CVE-2021-43949

Collapse comment: AB added a comment - 06/Jan/2022 1:22 AM, Edited by Security Metrics Bot - 09/Jan/2022 8:28 PM

AB added a comment - 06/Jan/2022 1:22 AM - edited

This is an independent assessment and you should evaluate its applicability to your own IT environment.

CVSS v3 score: 4.3 => Medium severity

Exploitability Metrics

Attack Vector	Network
Attack Complexity	Low
Privileges Required	Low
User Interaction	None

Scope Metric

Scope	Unchanged

Impact Metrics

Confidentiality	Low
Integrity	None
Availability	None

https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Expand comment: AB added a comment - 06/Jan/2022 1:22 AM, Edited by Security Metrics Bot - 09/Jan/2022 8:28 PM

AB added a comment - 06/Jan/2022 1:22 AM - edited This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 4.3 => Medium severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction None Scope Metric Scope Unchanged Impact Metrics Confidentiality Low Integrity None Availability None https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AB made changes - 06/Jan/2022 1:14 AM

Summary

Original: An unauthorized user can view private objects via the Custom Fields feature

New: An unauthorized user can view private objects via the Custom Fields feature - CVE registration for this issue is already in progress

AB made changes - 06/Jan/2022 1:13 AM

Description

Original: This vulnerability affects certain versions of Atlassian Jira Service Management Server. Please describe the impact of the vulnerability here. No known vulnerability could be read off of the parent.

New: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects via a Broken Access Control vulnerability in the Custom Fields feature. The affected versions are before version 4.21.0. *Affected versions:*  * version < 4.21.0 *Fixed versions:*  * 4.21.0

AB made changes - 06/Jan/2022 1:13 AM

Summary

Original: REST API Endpoint Leaked private object by [Custom Fields] to unauthorized user

New: An unauthorized user can view private objects via the Custom Fields feature

Load more older events