CVE-2019-20402 Missing authorization in Jira Server
System Administrators can download support zip files without re-authentication, exposing sensitive data in Atlassian Jira Server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-20402?
CVE-2019-20402 is a medium-severity missing authorization vulnerability in Atlassian Jira, published on 6 Feb 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their password via an improper authorization vulnerability.
Which versions are affected by CVE-2019-20402?
It affects 2 products.
Products include Atlassian Jira, Atlassian Jira Software Data Center.
How do I fix CVE-2019-20402?
No fix has been published for CVE-2019-20402 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-20402 being exploited?
There is no known exploitation of CVE-2019-20402 in the wild and no public exploit code.
Other vulnerabilities in Atlassian Jira
Sources
Also known as GHSA-wwjm-wrhr-958r.