CVE-2019-20412 Information disclosure in Jira Server
Remote attackers can enumerate workflow, project, issue, and status information via improper authentication in Jira Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-20412?
CVE-2019-20412 is a medium-severity vulnerability in Atlassian Jira, published on 29 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information via an Improper Authentication vulnerability: Workflow names; Project Key, if it is part of the workflow name; Issue Keys; Issue Types; Status Types. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.
Weakness: CWE-287
Which versions are affected by CVE-2019-20412?
It affects 4 products.
Products include Atlassian Jira, Atlassian Jira Data Center, Atlassian Jira Server, Atlassian Jira Software Data Center.
How do I fix CVE-2019-20412?
No fix has been published for CVE-2019-20412 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-20412 being exploited?
There is no known exploitation of CVE-2019-20412 in the wild and no public exploit code.
Other vulnerabilities in Atlassian Jira
Sources
Also known as GHSA-4r95-5hvx-m4wp.