cnvd - cnvd-2020-52942

cnvd-2020-52942

Vulnerability from cnvd

Title: Atlassian JIRA Server和Data Center授权问题漏洞

Description:

Atlassian JIRA Server和Atlassian JIRA Data Center都是澳大利亚Atlassian公司的产品。Atlassian JIRA Server是一套缺陷跟踪管理系统的服务器版本。该系统主要用于对工作中各类问题、缺陷进行跟踪管理。Atlassian JIRA Data Center是Atlassian JIRA的数据中心版本。

Atlassian JIRA Server和Data Center 8.5.5之前版本、8.6.0及之后版本（8.7.2版本已修复）和8.8.0及之后版本（8.8.1版本已修复）中的REST API组件存在存在授权问题漏洞。该漏洞源于网络系统或产品中缺少身份验证措施或身份验证强度不足。目前没有详细的漏洞细节提供。

Severity: 中

Patch Name: Atlassian JIRA Server和Data Center授权问题漏洞的补丁

Patch Description:

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://jira.atlassian.com/browse/JRASERVER-70926

Reference: https://nvd.nist.gov/vuln/detail/CVE-2020-4029

Impacted products

Name
['Atlassian JIRA Server <8.5.5', 'Atlassian Jira Data Center <8.5.5', 'Atlassian JIRA Server >=8.6.0，<8.7.2', 'Atlassian Jira Data Center >=8.6.0，<8.7.2', 'Atlassian JIRA Server >=8.8.0，<8.8.1', 'Atlassian Jira Data Center >=8.8.0，<8.8.1']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-4029"
    }
  },
  "description": "Atlassian JIRA Server\u548cAtlassian JIRA Data Center\u90fd\u662f\u6fb3\u5927\u5229\u4e9aAtlassian\u516c\u53f8\u7684\u4ea7\u54c1\u3002Atlassian JIRA Server\u662f\u4e00\u5957\u7f3a\u9677\u8ddf\u8e2a\u7ba1\u7406\u7cfb\u7edf\u7684\u670d\u52a1\u5668\u7248\u672c\u3002\u8be5\u7cfb\u7edf\u4e3b\u8981\u7528\u4e8e\u5bf9\u5de5\u4f5c\u4e2d\u5404\u7c7b\u95ee\u9898\u3001\u7f3a\u9677\u8fdb\u884c\u8ddf\u8e2a\u7ba1\u7406\u3002Atlassian JIRA Data Center\u662fAtlassian JIRA\u7684\u6570\u636e\u4e2d\u5fc3\u7248\u672c\u3002\n\nAtlassian JIRA Server\u548cData Center 8.5.5\u4e4b\u524d\u7248\u672c\u30018.6.0\u53ca\u4e4b\u540e\u7248\u672c\uff088.7.2\u7248\u672c\u5df2\u4fee\u590d\uff09\u548c8.8.0\u53ca\u4e4b\u540e\u7248\u672c\uff088.8.1\u7248\u672c\u5df2\u4fee\u590d\uff09\u4e2d\u7684REST API\u7ec4\u4ef6\u5b58\u5728\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u4e2d\u7f3a\u5c11\u8eab\u4efd\u9a8c\u8bc1\u63aa\u65bd\u6216\u8eab\u4efd\u9a8c\u8bc1\u5f3a\u5ea6\u4e0d\u8db3\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://jira.atlassian.com/browse/JRASERVER-70926",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-52942",
  "openTime": "2020-09-21",
  "patchDescription": "Atlassian JIRA Server\u548cAtlassian JIRA Data Center\u90fd\u662f\u6fb3\u5927\u5229\u4e9aAtlassian\u516c\u53f8\u7684\u4ea7\u54c1\u3002Atlassian JIRA Server\u662f\u4e00\u5957\u7f3a\u9677\u8ddf\u8e2a\u7ba1\u7406\u7cfb\u7edf\u7684\u670d\u52a1\u5668\u7248\u672c\u3002\u8be5\u7cfb\u7edf\u4e3b\u8981\u7528\u4e8e\u5bf9\u5de5\u4f5c\u4e2d\u5404\u7c7b\u95ee\u9898\u3001\u7f3a\u9677\u8fdb\u884c\u8ddf\u8e2a\u7ba1\u7406\u3002Atlassian JIRA Data Center\u662fAtlassian JIRA\u7684\u6570\u636e\u4e2d\u5fc3\u7248\u672c\u3002\r\n\r\nAtlassian JIRA Server\u548cData Center 8.5.5\u4e4b\u524d\u7248\u672c\u30018.6.0\u53ca\u4e4b\u540e\u7248\u672c\uff088.7.2\u7248\u672c\u5df2\u4fee\u590d\uff09\u548c8.8.0\u53ca\u4e4b\u540e\u7248\u672c\uff088.8.1\u7248\u672c\u5df2\u4fee\u590d\uff09\u4e2d\u7684REST API\u7ec4\u4ef6\u5b58\u5728\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u4e2d\u7f3a\u5c11\u8eab\u4efd\u9a8c\u8bc1\u63aa\u65bd\u6216\u8eab\u4efd\u9a8c\u8bc1\u5f3a\u5ea6\u4e0d\u8db3\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Atlassian JIRA Server\u548cData Center\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Atlassian JIRA Server \u003c8.5.5",
      "Atlassian Jira Data Center \u003c8.5.5",
      "Atlassian JIRA Server \u003e=8.6.0\uff0c\u003c8.7.2",
      "Atlassian Jira Data Center \u003e=8.6.0\uff0c\u003c8.7.2",
      "Atlassian JIRA Server \u003e=8.8.0\uff0c\u003c8.8.1",
      "Atlassian Jira Data Center \u003e=8.8.0\uff0c\u003c8.8.1"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-4029",
  "serverity": "\u4e2d",
  "submitTime": "2020-07-02",
  "title": "Atlassian JIRA Server\u548cData Center\u6388\u6743\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2020-4029 (GCVE-0-2020-4029)

Vulnerability from cvelistv5

Published

2020-07-01 01:35

Modified

2024-09-16 17:54

Severity ?

CWE

Improper authorization

Summary

The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0 before 8.8.1 allows remote attackers to enumerate project names via an improper authorization vulnerability.

References

▼	URL	Tags
	https://jira.atlassian.com/browse/JRASERVER-70926	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Atlassian	Jira Server and Data Center	Version: unspecified < 8.5.5 Version: 8.6.0 < unspecified Version: unspecified < 8.7.2 Version: 8.8.0 < unspecified Version: unspecified < 8.8.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:52:20.799Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jira.atlassian.com/browse/JRASERVER-70926"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jira Server and Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "lessThan": "8.5.5",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "8.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.7.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "8.8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.8.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2020-07-01T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0 before 8.8.1 allows remote attackers to enumerate project names via an improper authorization vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper authorization",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-01T01:35:29",
        "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "shortName": "atlassian"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.atlassian.com/browse/JRASERVER-70926"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@atlassian.com",
          "DATE_PUBLIC": "2020-07-01T00:00:00",
          "ID": "CVE-2020-4029",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Jira Server and Data Center",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "8.5.5"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "8.6.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "8.7.2"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "8.8.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "8.8.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Atlassian"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0 before 8.8.1 allows remote attackers to enumerate project names via an improper authorization vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jira.atlassian.com/browse/JRASERVER-70926",
              "refsource": "MISC",
              "url": "https://jira.atlassian.com/browse/JRASERVER-70926"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
    "assignerShortName": "atlassian",
    "cveId": "CVE-2020-4029",
    "datePublished": "2020-07-01T01:35:29.763354Z",
    "dateReserved": "2019-12-30T00:00:00",
    "dateUpdated": "2024-09-16T17:54:34.534Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted