Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, from version 8.6.0 before 8.9.2, and from version 8.10.0 before 8.10.1.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is 7.0.6 prior to version 7.13.16, 8.0.0 prior to 8.5.7, 8.6.0 prior to 8.9.2 or 8.10.0 prior to 8.10.1. It is, therefore, affected by a vulnerability which allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by Insecure Direct Object References (IDOR) vulnerability. Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper.

ID	Name	Product	Family	Severity
113736	Atlassian Jira 8.10.0 < 8.10.1 Disclosure Of Private Project Titles	Web App Scanning	Component Vulnerability	medium
113735	Atlassian Jira 8.6.0 < 8.9.2 Disclosure Of Private Project Titles	Web App Scanning	Component Vulnerability	medium
113734	Atlassian Jira 8.0.0 < 8.5.7 Disclosure Of Private Project Titles	Web App Scanning	Component Vulnerability	medium
113733	Atlassian Jira 7.0.6 < 7.13.16 Disclosure Of Private Project Titles	Web App Scanning	Component Vulnerability	medium
138837	Atlassian JIRA < 7.13.16 / 8.0.x < 8.5.7 / 8.6.x < 8.9.2 / 8.10.x < 8.10.1 Insecure Direct Object References (IDOR) (JRASERVER-71275)	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2020-14174

medium

Tenable Plugins

medium

medium

medium

medium

medium