Lucene search

AtlassianCVE-2021-43948

HistoryFeb 15, 2022 - 4:15 a.m.

CVE-2021-43948

2022-02-1504:15:07

atlassian

web.nvd.nist.gov

atlassian

jira

service management

server

data center

cve-2021-43948

nvd

improper authorization

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

35.3%

JSON

Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of private objects via an Improper Authorization vulnerability in the “Move objects” feature. The affected versions are before version 4.21.0.

Affected configurations

Nvd

Node

atlassianjira_service_managementRange<4.21.0data_center

atlassianjira_service_managementRange<4.21.0server

VendorProductVersionCPE
atlassianjira_service_management*cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*
atlassianjira_service_management*cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*

Vendor	Product	Version	CPE
atlassian	jira_service_management	*	cpe:2.3:a:atlassian:jira_service_management:::::data_center:::*
atlassian	jira_service_management	*	cpe:2.3:a:atlassian:jira_service_management:::::server:::*

CNA Affected

[
  {
    "product": "Jira Service Management Server",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "4.21.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Jira Service Management Data Center",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "4.21.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

jira.atlassian.com/browse/JSDSERVER-10981

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

35.3%

JSON

Related for CVE-2021-43948