#VU30161 Information disclosure in Jira Software - CVE-2019-20410

Vulnerability identifier: #VU30161

Vulnerability risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-20410

CWE-ID: CWE-200

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Jira Software
Client/Desktop applications / Other client software

Vendor: Atlassian

Description

The vulnerability allows a remote authenticated user to gain access to sensitive information.

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in the comment restriction feature. The affected versions are before version 7.6.17, from version 7.7.0 before 7.13.9, and from version 8.0.0 before 8.4.2.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Jira Software: 8.0.0-m0025 - 8.0.4, 8.1.0 - 8.1.3, 8.2.0 - 8.2.6, 8.3.0 - 8.3.5, 8.4.0 - 8.4.1

---

External links
https://jira.atlassian.com/browse/JRASERVER-70884

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.