4.3med
CVE-2019-20106
Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before versi…
Published 6 y ago · modified 4 mo ago · JSON
CVSS
4.3
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
1.1%
percentile 67%
Public exploits
0
none known
Summary
Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug.
Exploit prediction (EPSS)
1.14% probability of exploitation in the next 30 days, higher than 67% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N |
Affected products
- Atlassian Jira Server and Data Center
Classification
- Weakness
- CWE-276 Incorrect Default Permissions
References
- jira.atlassian.com /browse/JRASERVER-70543 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2019-20106
- NVD: CVE-2019-20106
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.