Description

The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for archived projects through a missing authorisation check.

Remediation

References

CVE-2019-3399

Related Vulnerabilities

Dolphin Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2008-3167)

PostgreSQL Other Vulnerability (CVE-2012-1618)

MySQL CVE-2020-14828 Vulnerability (CVE-2020-14828)

WordPress Plugin Social Media Widget by Acurax Cross-Site Request Forgery (3.2.5)

WordPress Plugin Ruben Boelinger wordTube 'wpPATH' Parameter Multiple Remote File Include Vulnerabilities (1.43)

Severity

High

Classification

CVE-2019-3399 CWE-862

Tags

Missing Update Known Vulnerabilities