CVE-2020-14178 - Vulnerability Details

Vendors	Products
Atlassian	Jira Jira Data Center Jira Server Jira Software Data Center

Link	Providers
https://jira.atlassian.com/browse/JRASERVER-71498

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Jira Server", "vendor": "Atlassian", "versions": [{"lessThan": "7.13.17", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "8.0.0", "versionType": "custom"}, {"lessThan": "8.5.8", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "8.6.0", "versionType": "custom"}, {"lessThan": "8.12.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2020-09-01T00:00:00", "descriptions": [{"lang": "en", "value": "Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7, from version 8.0.0 before 8.5.8, and from version 8.6.0 before 8.12.0."}], "problemTypes": [{"descriptions": [{"description": "Information Disclosure", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-09-01T04:25:13", "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://jira.atlassian.com/browse/JRASERVER-71498"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@atlassian.com", "DATE_PUBLIC": "2020-09-01T00:00:00", "ID": "CVE-2020-14178", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Jira Server", "version": {"version_data": [{"version_affected": "<", "version_value": "7.13.17"}, {"version_affected": ">=", "version_value": "8.0.0"}, {"version_affected": "<", "version_value": "8.5.8"}, {"version_affected": ">=", "version_value": "8.6.0"}, {"version_affected": "<", "version_value": "8.12.0"}]}}]}, "vendor_name": "Atlassian"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7, from version 8.0.0 before 8.5.8, and from version 8.6.0 before 8.12.0."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Information Disclosure"}]}]}, "references": {"reference_data": [{"name": "https://jira.atlassian.com/browse/JRASERVER-71498", "refsource": "MISC", "url": "https://jira.atlassian.com/browse/JRASERVER-71498"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T12:39:36.164Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://jira.atlassian.com/browse/JRASERVER-71498"}]}]}, "cveMetadata": {"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "assignerShortName": "atlassian", "cveId": "CVE-2020-14178", "datePublished": "2020-09-01T04:25:13.421216Z", "dateReserved": "2020-06-16T00:00:00", "dateUpdated": "2024-09-16T22:45:49.594Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Jira Server (string)

vendor : Atlassian (string)

versions : [ »

0 : { »

lessThan : 7.13.17 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

1 : { »

lessThan : unspecified (string)

status : affected (string)

version : 8.0.0 (string)

versionType : custom (string)

}

2 : { »

lessThan : 8.5.8 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

3 : { »

lessThan : unspecified (string)

status : affected (string)

version : 8.6.0 (string)

versionType : custom (string)

}

4 : { »

lessThan : 8.12.0 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

]

}

]

datePublic : 2020-09-01T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7, from version 8.0.0 before 8.5.8, and from version 8.6.0 before 8.12.0. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Information Disclosure (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2020-09-01T04:25:13 (string)

orgId : f08a6ab8-ed46-4c22-8884-d911ccfe3c66 (string)

shortName : atlassian (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://jira.atlassian.com/browse/JRASERVER-71498 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : security@atlassian.com (string)

DATE_PUBLIC : 2020-09-01T00:00:00 (string)

ID : CVE-2020-14178 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Jira Server (string)

version : { »

version_data : [ »

0 : { »

version_affected : < (string)

version_value : 7.13.17 (string)

}

1 : { »

version_affected : >= (string)

version_value : 8.0.0 (string)

}

2 : { »

version_affected : < (string)

version_value : 8.5.8 (string)

}

3 : { »

version_affected : >= (string)

version_value : 8.6.0 (string)

}

4 : { »

version_affected : < (string)

version_value : 8.12.0 (string)

}

]

}

]

}

vendor_name : Atlassian (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7, from version 8.0.0 before 8.5.8, and from version 8.6.0 before 8.12.0. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Information Disclosure (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://jira.atlassian.com/browse/JRASERVER-71498 (string)

refsource : MISC (string)

url : https://jira.atlassian.com/browse/JRASERVER-71498 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-04T12:39:36.164Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://jira.atlassian.com/browse/JRASERVER-71498 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : f08a6ab8-ed46-4c22-8884-d911ccfe3c66 (string)

assignerShortName : atlassian (string)

cveId : CVE-2020-14178 (string)

datePublished : 2020-09-01T04:25:13.421216Z (string)

dateReserved : 2020-06-16T00:00:00 (string)

dateUpdated : 2024-09-16T22:45:49.594Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*", "matchCriteriaId": "34FEEA69-4B5F-4EDB-8007-F4918A8A4EDA", "versionEndExcluding": "7.13.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA8CC2B5-6238-4E5B-A7AC-34279A4FAF15", "versionEndExcluding": "8.5.8", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", "matchCriteriaId": "B4F4A10D-0C84-46C6-8428-A9B53541EB00", "versionEndExcluding": "8.12.0", "versionStartIncluding": "8.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B666569-FD4E-4C6B-9262-FE6D14F29C4F", "versionEndExcluding": "8.5.8", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "E6D370E7-0939-40F3-942C-CA6D66B8AAC0", "versionEndExcluding": "8.12.0", "versionStartIncluding": "8.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_software_data_center:*:*:*:*:*:*:*:*", "matchCriteriaId": "45209CBE-8CDC-4D75-987D-95829E4DB999", "versionEndExcluding": "7.13.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7, from version 8.0.0 before 8.5.8, and from version 8.6.0 before 8.12.0."}, {"lang": "es", "value": "Las versiones afectadas de Atlassian Jira Server y Data Center permiten  a atacantes remotos enumerar las claves de proyecto por medio de una vulnerabilidad de Divulgaci\u00f3n de Informaci\u00f3n en el endpoint /browse.PROJECTKEY.&#xa0;Las versiones afectadas son anteriores a versi\u00f3n 7.13.7, desde la versi\u00f3n 8.0.0 anteriores a 8.5.8 y desde la versi\u00f3n 8.6.0 anteriores a 8.12.0"}], "id": "CVE-2020-14178", "lastModified": "2024-11-21T05:02:49.050", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-09-01T05:15:10.063", "references": [{"source": "security@atlassian.com", "tags": ["Permissions Required"], "url": "https://jira.atlassian.com/browse/JRASERVER-71498"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required"], "url": "https://jira.atlassian.com/browse/JRASERVER-71498"}], "sourceIdentifier": "security@atlassian.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 34FEEA69-4B5F-4EDB-8007-F4918A8A4EDA (string)

versionEndExcluding : 7.13.7 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* (string)

matchCriteriaId : CA8CC2B5-6238-4E5B-A7AC-34279A4FAF15 (string)

versionEndExcluding : 8.5.8 (string)

versionStartIncluding : 8.0.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* (string)

matchCriteriaId : B4F4A10D-0C84-46C6-8428-A9B53541EB00 (string)

versionEndExcluding : 8.12.0 (string)

versionStartIncluding : 8.6.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 6B666569-FD4E-4C6B-9262-FE6D14F29C4F (string)

versionEndExcluding : 8.5.8 (string)

versionStartIncluding : 8.0.0 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* (string)

matchCriteriaId : E6D370E7-0939-40F3-942C-CA6D66B8AAC0 (string)

versionEndExcluding : 8.12.0 (string)

versionStartIncluding : 8.6.0 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:atlassian:jira_software_data_center:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 45209CBE-8CDC-4D75-987D-95829E4DB999 (string)

versionEndExcluding : 7.13.7 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7, from version 8.0.0 before 8.5.8, and from version 8.6.0 before 8.12.0. (string)

}

1 : { »

lang : es (string)

value : Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos enumerar las claves de proyecto por medio de una vulnerabilidad de Divulgación de Información en el endpoint /browse.PROJECTKEY. Las versiones afectadas son anteriores a versión 7.13.7, desde la versión 8.0.0 anteriores a 8.5.8 y desde la versión 8.6.0 anteriores a 8.12.0 (string)

}

]

id : CVE-2020-14178 (string)

lastModified : 2024-11-21T05:02:49.050 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : NONE (string)

baseScore : 5 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : NONE (string)

vectorString : AV:N/AC:L/Au:N/C:P/I:N/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 10 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2020-09-01T05:15:10.063 (string)

references : [ »

0 : { »

source : security@atlassian.com (string)

tags : [ »

0 : Permissions Required (string)

]

url : https://jira.atlassian.com/browse/JRASERVER-71498 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Permissions Required (string)

]

url : https://jira.atlassian.com/browse/JRASERVER-71498 (string)

}

]

sourceIdentifier : security@atlassian.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object