Improper access control

2021-10-2605:15:00

PRIOn knowledge base

www.prio-n.com

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.7%

JSON

Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings via a Broken Access Control vulnerability in the ReplicationSettings!default.jspa endpoint. The affected versions are before version 8.6.0, from version 8.7.0 before 8.13.12, and from version 8.14.0 before 8.20.1.

CPENameOperatorVersion
jiralt8.6.0
jira_data_centerge8.7.0
jira_data_centerlt8.13.12
jira_serverge8.7.0
jira_serverlt8.13.12
jira_serverge8.14.0
jira_serverlt8.20.1
jira_software_data_centerlt8.6.0
jira_software_data_centerge8.14.0
jira_software_data_centerlt8.20.1

Name	Operator	Version
jira	lt	8.6.0
jira_data_center	ge	8.7.0
jira_data_center	lt	8.13.12
jira_server	ge	8.7.0
jira_server	lt	8.13.12
jira_server	ge	8.14.0
jira_server	lt	8.20.1
jira_software_data_center	lt	8.6.0
jira_software_data_center	ge	8.14.0
jira_software_data_center	lt	8.20.1

References

jira.atlassian.com/browse/JRASERVER-72940