CVE-2018-20826

2019-08-0900:00:00

CWE-863

atlassian

www.cve.org

4.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.6%

JSON

The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter in issues via a missing authorisation check.

CNA Affected

[
  {
    "product": "Jira",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "7.12.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

jira.atlassian.com/browse/JRASERVER-69239