Description (CNA)
The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is valid via a missing permissions check.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Atlassian / Jira | affected unspecified before 8.4.0 |
CWE
CWE-863
References
- https://jira.atlassian.com/browse/JRASERVER-69792
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0836
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0837
ADP enrichment
No English description supplied.