Lucene search

AtlassianCVE-2019-14997

HistorySep 11, 2019 - 2:15 p.m.

CVE-2019-14997

2019-09-1114:15:11

CWE-524

atlassian

web.nvd.nist.gov

jira

cve-2019-14997

accesslogfilter

information expose

caching vulnerability

reverse proxy

load balancer

cdn

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

33.0%

JSON

The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers to learn details about other users, including their username, via an information expose through caching vulnerability when Jira is configured with a reverse Proxy and or a load balancer with caching or a CDN.

Affected configurations

Nvd

Node

atlassianjira_serverRange7.13.0–8.4.0

VendorProductVersionCPE
atlassianjira_server*cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
atlassian	jira_server	*	cpe:2.3:a:atlassian:jira_server::::::::

CNA Affected

[
  {
    "product": "Jira",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "8.4.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

jira.atlassian.com/browse/JRASERVER-69794

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

33.0%

JSON

Related for CVE-2019-14997