Vulnerability Description
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7, from version 8.0.0 before 8.5.8, and from version 8.6.0 before 8.12.0.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Jira | < 7.13.7 |
| Atlassian | Jira Data Center | >= 8.0.0, < 8.5.8 |
| Atlassian | Jira Server | >= 8.0.0, < 8.5.8 |
| Atlassian | Jira Software Data Center | < 7.13.7 |
References
- https://jira.atlassian.com/browse/JRASERVER-71498Permissions Required
- https://jira.atlassian.com/browse/JRASERVER-71498Permissions Required
FAQ
What is CVE-2020-14178?
CVE-2020-14178 is a vulnerability with a CVSS score of 7.5 (HIGH). Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected...
How severe is CVE-2020-14178?
CVE-2020-14178 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-14178?
Check the references section above for vendor advisories and patch information. Affected products include: Atlassian Jira, Atlassian Jira Data Center, Atlassian Jira Server, Atlassian Jira Software Data Center.