PT-2019-13921 · Atlassian · Jira

Published 2019-09-11 · Updated 2022-04-22 · CVE-2019-14995

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jira versions prior to 8.4.0

Description The issue concerns a missing permissions check in the /rest/api/1.0/render resource, allowing remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is valid.

Recommendations For versions prior to 8.4.0, update to version 8.4.0 or later to resolve the issue.

Exploit

Fix

Incorrect Authorization

Missing Authorization

Weakness Enumeration

CWE-863

CWE-862

Related Identifiers

CVE-2019-14995

Affected Products

Jira

References · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0836 · Exploit
• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0837 · Exploit
• https://jira.atlassian.com/browse/JRASERVER-69792 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14995 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14995 · Security Note