Information disclosure

2020-09-0105:15:00

PRIOn knowledge base

www.prio-n.com

7.3 High

AI Score

Confidence

High

0.018 Low

EPSS

Percentile

88.1%

JSON

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7, from version 8.0.0 before 8.5.8, and from version 8.6.0 before 8.12.0.

CPENameOperatorVersion
jiralt7.13.7
jira_data_centerge8.0.0
jira_data_centerlt8.5.8
jira_data_centerge8.6.0
jira_data_centerlt8.12.0
jira_serverge8.0.0
jira_serverlt8.5.8
jira_serverge8.6.0
jira_serverlt8.12.0
jira_software_data_centerlt7.13.7

Name	Operator	Version
jira	lt	7.13.7
jira_data_center	ge	8.0.0
jira_data_center	lt	8.5.8
jira_data_center	ge	8.6.0
jira_data_center	lt	8.12.0
jira_server	ge	8.0.0
jira_server	lt	8.5.8
jira_server	ge	8.6.0
jira_server	lt	8.12.0
jira_software_data_center	lt	7.13.7

References

jira.atlassian.com/browse/JRASERVER-71498