Description

Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug.

Remediation

References

CVE-2019-20106

Related Vulnerabilities

WordPress Plugin Scriptless Social Sharing Cross-Site Scripting (3.2.1)

Drupal CVE-2017-6919 Vulnerability (CVE-2017-6919)

Oracle Database Server Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2007-0270)

Oracle JRE Cryptographic Issues Vulnerability (CVE-2012-5373)

Drupal Core 7.x Security Bypass (7.0 - 7.68)

Severity

Medium

Classification

CVE-2019-20106 CWE-276

Tags

Missing Update Known Vulnerabilities