4.3

CVE-2019-20407

The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information in projects that they do not have access to through an missing authorisation check.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Atlassian ≫ Jira Data Center Version >= 8.4.1 < 8.5.3
Atlassian ≫ Jira Data Center Version >= 8.5.4 < 8.6.1
Atlassian ≫ Jira Data Center Version > 8.6.2 < 8.7.0
Atlassian ≫ Jira Server Version >= 8.4.1 < 8.5.3
Atlassian ≫ Jira Server Version >= 8.5.4 < 8.6.1
Atlassian ≫ Jira Server Version >= 8.6.2 < 8.7.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.504
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.