Jira - Information Disclosure (CVE-2020-14179)
- Severity
- CVSSv3 Score
- 5.3
- Exploitable with Sniper
- Yes
- Vulnerability description
Jira is affected by an Information Disclosure vulnerability, located in the
/secure/QueryComponent!Default.jspaendpoint. This allows attackers to read sensitive information from the target system by sending a specially crafted HTTP GET request to the vulnerable endpoint. An unauthenticated attacker can view custom field names and custom SLA names from the Jira server and can potentially be a starting point for exposing an additional attack surface.- Exploit capabilities
Sniper can read arbitrary files from the target system and extract them as evidence.
- Risk description
The risk exists that a remote unauthenticated attacker could exploit this vulnerability to view custom field names and custom SLA names from the
QueryComponentJSON file located on the file system of the server.- Recommendation
Upgrade Jira to the latest version.
- Detectable with
- Network Scanner
- Vuln date
- Sep 2020
- Published at
- Updated at
- Software Type
- Project management
- Vendor
- Atlassian
- Product
- Jira
- Codename
- Not available