{"containers": {"cna": {"affected": [{"product": "Jira Software", "vendor": "Atlassian", "versions": [{"lessThan": "8.6.1", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2020-03-17T00:00:00", "descriptions": [{"lang": "en", "value": "The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information in projects that they do not have access to through an missing authorisation check."}], "problemTypes": [{"descriptions": [{"description": "Improper Authorization", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-03-17T03:10:12", "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://jira.atlassian.com/browse/JRASERVER-70599"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@atlassian.com", "DATE_PUBLIC": "2020-03-17T00:00:00", "ID": "CVE-2019-20407", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Jira Software", "version": {"version_data": [{"version_affected": "<", "version_value": "8.6.1"}]}}]}, "vendor_name": "Atlassian"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information in projects that they do not have access to through an missing authorisation check."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Improper Authorization"}]}]}, "references": {"reference_data": [{"name": "https://jira.atlassian.com/browse/JRASERVER-70599", "refsource": "MISC", "url": "https://jira.atlassian.com/browse/JRASERVER-70599"}]}}}}, "cveMetadata": {"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "assignerShortName": "atlassian", "cveId": "CVE-2019-20407", "datePublished": "2020-03-17T00:00:00", "dateReserved": "2020-01-23T00:00:00", "dateUpdated": "2020-03-17T03:10:12", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", "matchCriteriaId": "D575CB76-2CB1-469E-A422-BFB78E9E98D3", "versionEndExcluding": "8.5.3", "versionStartIncluding": "8.4.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", "matchCriteriaId": "74CD8906-D8ED-4C08-BBB1-3D5F1E6D10E0", "versionEndExcluding": "8.6.1", "versionStartIncluding": "8.5.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", "matchCriteriaId": "F6831C36-D5E9-4CC1-95DA-46A30CE964BA", "versionEndExcluding": "8.7.0", "versionStartExcluding": "8.6.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "541F2D87-10C7-4CA3-A193-466088F14EB9", "versionEndExcluding": "8.5.3", "versionStartIncluding": "8.4.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "CC040D5A-4C98-4BBE-BF64-56E6F88BEDE2", "versionEndExcluding": "8.6.1", "versionStartIncluding": "8.5.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "1884A441-8487-40FF-AEE3-E025670C0723", "versionEndExcluding": "8.7.0", "versionStartIncluding": "8.6.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information in projects that they do not have access to through an missing authorisation check."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en el servidor de aplicaciones SPPA-T3000 (todas las versiones anteriores a la versi\u00f3n Service Pack R8.2 SP2). Un atacante con acceso de red al servidor de aplicaciones podr\u00eda obtener acceso a registros y archivos de configuraci\u00f3n enviando paquetes espec\u00edficamente dise\u00f1ados a 80 / tcp. Tenga en cuenta que un atacante debe tener acceso de red al Servidor de aplicaciones para aprovechar esta vulnerabilidad. En el momento de la publicaci\u00f3n del aviso no se conoc\u00eda la explotaci\u00f3n p\u00fablica de esta vulnerabilidad de seguridad."}], "id": "CVE-2019-20407", "lastModified": "2022-03-30T13:21:19.000", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-03-17T03:15:11.043", "references": [{"source": "security@atlassian.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/JRASERVER-70599"}], "sourceIdentifier": "security@atlassian.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}