Incorrect default permissions in Atlassian JIRA

Published: 2020-02-06 | Updated: 2020-07-17

Risk	Low
Patch available	YES
Number of vulnerabilities	1
CVE-ID	CVE-2019-20106
CWE-ID	CWE-276
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Jira Software Client/Desktop applications / Other client software
Vendor	Atlassian

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Incorrect default permissions

EUVDB-ID: #VU30378

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-20106

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to manipulate data.

Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Jira Software: 8.0.0 - 8.5.3

External links

http://jira.atlassian.com/browse/JRASERVER-70543

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.