Description

Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in some situations this may have allowed unauthorised attackers to determine if certain resources exist or not through an Information Disclosure vulnerability.

Remediation

References

CVE-2020-4028

Related Vulnerabilities

WordPress Plugin Easy Google Map Cross-Site Scripting (1.1.4)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-38263)

WordPress Plugin Insert or Embed Articulate Content into WordPress Remote Code Execution (4.2997)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-2359)

WordPress Plugin Fathom Analytics Cross-Site Scripting (3.0.4)

Severity

Medium

Classification

CVE-2020-4028 CWE-203

Tags

Missing Update Known Vulnerabilities