Description

Due to an information disclosure vulnerability, Jira's QueryComponent!Default.jspa endpoint allows unauthenticated attackers to view custom field names and custom SLA names

Remediation

Consult "Web references" for more information about solutions.

References

Sensitive data exposure via /secure/QueryComponent!Default.jspa endpoint - CVE-2020-14179

Related Vulnerabilities

Oracle HTTP Server CVE-2013-6438 Vulnerability (CVE-2013-6438)

Ruby Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-4522)

Oracle Database Server Other Vulnerability (CVE-2007-0269)

SugarCRM Missing Authorization Vulnerability (CVE-2020-7472)

Claroline Other Vulnerability (CVE-2006-5256)

Severity

Medium

Classification

CVE-2020-14179 CWE-288 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Information Disclosure Known Vulnerabilities