Information disclosure

2021-09-0802:15:00

PRIOn knowledge base

www.prio-n.com

4.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.5%

JSON

Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an Information Disclosure vulnerability in the /rest/api/latest/projectvalidate/key endpoint. The affected versions are before version 8.5.18, from version 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2.

CPENameOperatorVersion
data_centerlt8.5.18
jiralt8.5.18
jira_data_centerge8.6.0
jira_data_centerlt8.13.10
jira_data_centerge8.14.0
jira_data_centerlt8.18.2
jira_serverge8.6.0
jira_serverlt8.13.10
jira_serverge8.14.0
jira_serverlt8.18.2

Name	Operator	Version
data_center	lt	8.5.18
jira	lt	8.5.18
jira_data_center	ge	8.6.0
jira_data_center	lt	8.13.10
jira_data_center	ge	8.14.0
jira_data_center	lt	8.18.2
jira_server	ge	8.6.0
jira_server	lt	8.13.10
jira_server	ge	8.14.0
jira_server	lt	8.18.2

References

jira.atlassian.com/browse/JRASERVER-72715