Lucene search

[email protected]CVE-2019-20410

HistoryJul 03, 2020 - 12:00 a.m.

CVE-2019-20410

2020-07-0300:00:00

[email protected]

web.nvd.nist.gov

atlassian

jira

server

data center

information disclosure

vulnerability

cve-2019-20410

nvd

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.1 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.3%

JSON

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in the comment restriction feature. The affected versions are before version 7.6.17, from version 7.7.0 before 7.13.9, and from version 8.0.0 before 8.4.2.

Affected configurations

NVD

Node

atlassianjiraRange<7.6.17

atlassianjira_data_centerRange7.7.0–7.13.9

atlassianjira_data_centerRange8.0.0–8.4.2

atlassianjira_serverRange7.7.0–7.13.9

atlassianjira_serverRange8.0.0–8.4.2

atlassianjira_software_data_centerRange<7.6.17

CPENameOperatorVersion
atlassian:jiraatlassian jiralt7.6.17
atlassian:jira_data_centeratlassian jira data centerlt7.13.9
atlassian:jira_data_centeratlassian jira data centerlt8.4.2
atlassian:jira_serveratlassian jira serverlt7.13.9
atlassian:jira_serveratlassian jira serverlt8.4.2
atlassian:jira_software_data_centeratlassian jira software data centerlt7.6.17

CPE	Name	Operator	Version
atlassian:jira	atlassian jira	lt	7.6.17
atlassian:jira_data_center	atlassian jira data center	lt	7.13.9
atlassian:jira_data_center	atlassian jira data center	lt	8.4.2
atlassian:jira_server	atlassian jira server	lt	7.13.9
atlassian:jira_server	atlassian jira server	lt	8.4.2
atlassian:jira_software_data_center	atlassian jira software data center	lt	7.6.17

CNA Affected

[
  {
    "product": "Jira Server",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "7.6.17",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.7.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.13.9",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.0.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.4.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

jira.atlassian.com/browse/JRASERVER-70884

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.1 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.3%

JSON

Related for CVE-2019-20410

prion1 cvelist1 nvd1 atlassian2 nessus1