Lucene search

[email protected]CVE-2019-20106

HistoryFeb 06, 2020 - 3:15 a.m.

CVE-2019-20106

2020-02-0603:15:10

CWE-276

[email protected]

web.nvd.nist.gov

atlassian

jira

server

data center

cve-2019-20106

remote attack

access control

bug

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.5%

JSON

Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug.

Affected configurations

NVD

Node

atlassianjiraRange<7.13.12

atlassianjira_data_centerRange8.0.0–8.5.4

atlassianjira_data_centerMatch8.6.0

atlassianjira_serverRange8.0.0–8.5.4

atlassianjira_serverMatch8.6.0

atlassianjira_software_data_centerRange<7.13.12

CPENameOperatorVersion
atlassian:jiraatlassian jiralt7.13.12
atlassian:jira_data_centeratlassian jira data centerlt8.5.4
atlassian:jira_data_centeratlassian jira data centereq8.6.0
atlassian:jira_serveratlassian jira serverlt8.5.4
atlassian:jira_serveratlassian jira servereq8.6.0
atlassian:jira_software_data_centeratlassian jira software data centerlt7.13.12

CPE	Name	Operator	Version
atlassian:jira	atlassian jira	lt	7.13.12
atlassian:jira_data_center	atlassian jira data center	lt	8.5.4
atlassian:jira_data_center	atlassian jira data center	eq	8.6.0
atlassian:jira_server	atlassian jira server	lt	8.5.4
atlassian:jira_server	atlassian jira server	eq	8.6.0
atlassian:jira_software_data_center	atlassian jira software data center	lt	7.13.12

CNA Affected

[
  {
    "product": "Jira Server and Data Center",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "7.13.12",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.4.1",
        "versionType": "custom"
      },
      {
        "lessThan": "8.5.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.6.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.6.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

jira.atlassian.com/browse/JRASERVER-70543

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.5%

JSON

Related for CVE-2019-20106

cvelist1 prion1 atlassian2 nvd1 nessus1