PT-2019-13921 · Atlassian · Jira

Publicado 2019-09-11 · Atualizado 2022-04-22 · CVE-2019-14995

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jira versions prior to 8.4.0

Description The issue concerns a missing permissions check in the /rest/api/1.0/render resource, allowing remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is valid.

Recommendations For versions prior to 8.4.0, update to version 8.4.0 or later to resolve the issue.

Exploit

Correção

Incorrect Authorization

Missing Authorization

Enumeração de Fraquezas

CWE-863

CWE-862

Identificadores relacionados

CVE-2019-14995

Produtos afetados

Jira

Referências · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0836 · Exploit
• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0837 · Exploit
• https://jira.atlassian.com/browse/JRASERVER-69792 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-14995 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-14995 · Nota de Segurança