PT-2020-14726 · Atlassian · Gantt-Chart For Jira

Sebastian Auwaerter · Published 2020-08-04 · Updated 2025-07-25 · CVE-2020-15943

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gantt-Chart for Jira versions prior to 5.5.4

Description An issue in the Gantt-Chart module allows authenticated attackers to read and write to the module configuration of other users due to a missing privilege check. This can also be used to deliver an XSS payload to other users' dashboards.

Recommendations For versions prior to 5.5.4, update to version 5.5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Gantt-Chart module to minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

XSS

Weakness Enumeration

CWE-862

CWE-79

Related Identifiers

CVE-2020-15943

GHSA-49JM-G4M8-X53P

Affected Products

Gantt-Chart For Jira

References · 15

• 🔥 http://seclists.org/fulldisclosure/2020/Aug/0 · Exploit
• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-029.txt · Exploit
• 🔥 http://packetstormsecurity.com/files/158751/Gantt-Chart-For-Jira-5.5.3-Missing-Privilege-Check.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-15943 · Security Note
• https://osv.dev/vulnerability/GHSA-49jm-g4m8-x53p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-45406 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15943 · Vendor Advisory
• https://github.com/codeigniter4/CodeIgniter4/blob/v4.6.2/system/Debug/Toolbar.php#L496 · Note
• https://github.com/codeigniter4/CodeIgniter4 · Note
• https://github.com/codeigniter4/framework/blob/v4.6.2/system/Debug/Toolbar.php#L496 · Note
• https://exploit-db.com/exploits/50556 · Note
• https://t.me/cybersecuritytechnologies/1532 · Telegram Post
• https://t.me/defcon_news/53682 · Telegram Post
• https://marketplace.atlassian.com/apps/28997/gantt-chart-for-jira?hosting=cloud&tab=overview · Note
• https://medium.com/@talktoshweta0/when-debugging-bites-back-exposing-a-persistent-xss-in-codeigniter4-c9caf804a190 · Note