CVE-2019-20403 Information disclosure in Jira Server
Remote attackers can determine if a Jira project key exists via an API information disclosure vulnerability in Jira Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-20403?
CVE-2019-20403 is a medium-severity vulnerability in Atlassian Jira Data Center, published on 6 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an information disclosure vulnerability.
Which versions are affected by CVE-2019-20403?
It affects 2 products.
Products include Atlassian Jira Data Center, Atlassian Jira Server.
How do I fix CVE-2019-20403?
No fix has been published for CVE-2019-20403 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-20403 being exploited?
There is no known exploitation of CVE-2019-20403 in the wild and no public exploit code.
Other vulnerabilities in Atlassian Jira Data Center
Sources
Also known as GHSA-gw9f-7gjm-4824.