Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, from version 8.6.0 before 8.9.2, and from version 8.10.0 before 8.10.1.
References
| Link | Resource |
|---|---|
| https://jira.atlassian.com/browse/JRASERVER-71275 | Issue Tracking Vendor Advisory |
| https://jira.atlassian.com/browse/JRASERVER-71275 | Issue Tracking Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 05:02
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://jira.atlassian.com/browse/JRASERVER-71275 - Issue Tracking, Vendor Advisory |
30 Mar 2022, 13:21
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* cpe:2.3:a:atlassian:jira_data_center:8.10.0:*:*:*:*:*:*:* |
25 Mar 2022, 18:14
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:atlassian:jira_server:8.10.0:*:*:*:*:*:*:* |
25 Mar 2022, 17:20
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-639 | |
| CPE | cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* |
Information
Published : 2020-07-13 05:15
Updated : 2024-11-21 05:02
NVD link : CVE-2020-14174
Mitre link : CVE-2020-14174
CVE.ORG link : CVE-2020-14174
JSON object : View
Products Affected
atlassian
- jira
- jira_server
- jira_data_center
- jira_software_data_center
CWE
CWE-639
Authorization Bypass Through User-Controlled Key