• Type: Bug
• Resolution: Fixed
• Priority: Low
• Fix Version/s: 4.12.0
• Affects Version/s: 4.8.1
• Component/s: API and Integrations
• Labels:

  • CVE-2020-14180
  • advisory
  • advisory-released
  • bugbounty
  • cvss-medium
  • impossible-to-resolve-in-vf
  • information-disclosure
  • no-cvss-required
  • security
  • security-imported

[JSDSERVER-6917] Information disclosure in API and Integrations - CVE-2020-14180

David Black made changes - 19/Nov/2020 4:46 AM

Labels

Original: CVE-2020-14180 advisory advisory-to-release bugbounty cvss-medium impossible-to-resolve-in-vf information-disclosure no-cvss-required security security-imported

New: CVE-2020-14180 advisory advisory-released bugbounty cvss-medium impossible-to-resolve-in-vf information-disclosure no-cvss-required security security-imported

Security Metrics Bot made changes - 28/Oct/2020 5:45 PM

Labels

Original: CVE-2020-14180 advisory advisory-to-release bugbounty cvss-medium information-disclosure no-cvss-required security security-imported

New: CVE-2020-14180 advisory advisory-to-release bugbounty cvss-medium impossible-to-resolve-in-vf information-disclosure no-cvss-required security security-imported

AB made changes - 21/Sep/2020 12:53 AM

Labels

Original: advisory advisory-to-release bugbounty cve-in-progress cvss-medium information-disclosure no-cvss-required security security-imported

New: CVE-2020-14180 advisory advisory-to-release bugbounty cvss-medium information-disclosure no-cvss-required security security-imported

AB made changes - 21/Sep/2020 12:53 AM

Security

Original: Atlassian Staff [ 10750 ]

AB made changes - 21/Sep/2020 12:53 AM

Summary

Original: Information disclosure in API and Integrations - CVE-PENDING

New: Information disclosure in API and Integrations - CVE-2020-14180

AB made changes - 15/Sep/2020 1:10 AM

Description

Original: Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to view Project Request-Types and Descriptions, via an Information Disclosure vulnerability in the `/rest/servicedesk/1/servicedesk/67/request-type-fields/editform` endpoint. *Affected versions:*  * version < 4.12.0 *Fixed versions:*  * 4.12.0

New: Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to view Project Request-Types and Descriptions, via an Information Disclosure vulnerability in the editform request-type-fields resource. *Affected versions:*  * version < 4.12.0 *Fixed versions:*  * 4.12.0

AB made changes - 10/Sep/2020 4:36 AM

Labels

Original: advisory advisory-to-release bugbounty cvss-medium information-disclosure no-cvss-required security security-imported

New: advisory advisory-to-release bugbounty cve-in-progress cvss-medium information-disclosure no-cvss-required security security-imported

AB made changes - 10/Sep/2020 4:36 AM

Description

Original: Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in API and Integrations. *Affected versions:*  * version < 4.12.0 *Fixed versions:*  * 4.12.0

New: Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to view Project Request-Types and Descriptions, via an Information Disclosure vulnerability in the `/rest/servicedesk/1/servicedesk/67/request-type-fields/editform` endpoint. *Affected versions:*  * version < 4.12.0 *Fixed versions:*  * 4.12.0

AB made changes - 10/Sep/2020 4:34 AM

Labels

Original: advisory advisory-to-release bugbounty cvss-medium information-disclosure no-cvss-required security

New: advisory advisory-to-release bugbounty cvss-medium information-disclosure no-cvss-required security security-imported

Przemyslaw Czuj made changes - 26/Aug/2020 5:41 PM

Resolution		New: Fixed [ 1 ]
Status	Original: Gathering Impact [ 12072 ]	New: Closed [ 6 ]

Load more older events