Improper access control

2020-02-0603:15:00

PRIOn knowledge base

www.prio-n.com

4.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.5%

JSON

Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug.

CPENameOperatorVersion
jiralt7.13.12
jira_data_centerge8.0.0
jira_data_centerlt8.5.4
jira_data_centereq8.6.0
jira_serverge8.0.0
jira_serverlt8.5.4
jira_servereq8.6.0
jira_software_data_centerlt7.13.12

Name	Operator	Version
jira	lt	7.13.12
jira_data_center	ge	8.0.0
jira_data_center	lt	8.5.4
jira_data_center	eq	8.6.0
jira_server	ge	8.0.0
jira_server	lt	8.5.4
jira_server	eq	8.6.0
jira_software_data_center	lt	7.13.12

References

jira.atlassian.com/browse/JRASERVER-70543