Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to version 7.13.12, 8.0.0 prior to 8.5.4 or 8.6.0 prior to 8.6.1. It is, therefore, affected by a vulnerability which permits remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 7.13.12, 8.x prior to 8.5.4 or 8.6.x prior to 8.6.1. It is, therefore, affected by a broken access control vulnerability in the issue comments component. An authenticated, remote attacker can exploit this issue to bypass commenting permission and make comments on arbitrary tickets.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

ID	Name	Product	Family	Severity
113772	Atlassian Jira 8.6.0 < 8.6.1 Comment Permissions Broken Access Control	Web App Scanning	Component Vulnerability	medium
113771	Atlassian Jira 8.0.0 < 8.5.4 Comment Permissions Broken Access Control	Web App Scanning	Component Vulnerability	medium
113770	Atlassian Jira < 7.13.12 Comment Permissions Broken Access Control	Web App Scanning	Component Vulnerability	medium
139797	Atlassian Jira < 7.13.12, 8.x < 8.5.4, 8.6.x < 8.6.1 Broken Access Control (JRASERVER-70543)	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2019-20106

medium

Tenable Plugins

medium

medium

medium

medium