Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, from version 8.6.0 before 8.9.2, and from version 8.10.0 before 8.10.1.

Remediation

References

CVE-2020-14174

Related Vulnerabilities

CakePHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3712)

Ruby on Rails Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2014-0080)

Ruby on Rails Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2008-4094)

Ruby on Rails Improper Input Validation Vulnerability (CVE-2010-3933)

WordPress Plugin Conditional Marketing Mailer for WooCommerce Security Bypass (1.5.1)

Severity

Medium

Classification

CVE-2020-14174 CWE-639

Tags

Missing Update Known Vulnerabilities