CVE-2020-4029

2020-07-0100:00:00

atlassian

www.cve.org

4.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.5%

JSON

The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0 before 8.8.1 allows remote attackers to enumerate project names via an improper authorization vulnerability.

CNA Affected

[
  {
    "product": "Jira Server and Data Center",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "8.5.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.6.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.7.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.8.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.8.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

jira.atlassian.com/browse/JRASERVER-70926