CVE-2020-14181

MEDIUM severity · CVSS 5.3 · Information disclosure

5.3CVSS MEDIUM

Summary

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactLow

Integrity impactNone

Availability impactNone

Exploit probability (EPSS)94%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products we track (1)

Atlassian Jira

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
https://jira.atlassian.com/browse/JRASERVER-71560Advisory
https://jira.atlassian.com/browse/JRASERVER-71560Advisory
http://packetstormsecurity.com/files/161730/Atlassian-JIRA-8.11.1-User-Enumeration.htmlAdvisory
http://packetstormsecurity.com/files/161730/Atlassian-JIRA-8.11.1-User-Enumeration.htmlAdvisory