« Volver al listado

CVE-2019-20101

Estado: ModificadaMedia (5.3)—

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view whitelist rules via a Broken Access Control vulnerability in the /rest/whitelist/<version>/check endpoint. The affected versions are before version 8.13.3, and from version 8.14.0 before 8.14.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Atlassian — Data CenterAtlassian — Jira

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-20101",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2019-20101",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-09T16:12:44.831752Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@atlassian.com",
      "affectedData": [
        {
          "vendor": "Atlassian",
          "product": "Jira Server",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "8.13.3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "8.14.0",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "8.14.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Atlassian",
          "product": "Jira Data Center",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "8.13.3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "8.14.0",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "8.14.1",
              "versionType": "custom"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*"
          ],
          "vendor": "atlassian",
          "product": "jira_data_center",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "8.13.3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "8.14.0",
              "lessThan": "8.14.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*"
          ],
          "vendor": "atlassian",
          "product": "jira_server",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "8.13.3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "8.14.0",
              "lessThan": "8.14.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2021-09-14T05:15:07.437",
  "references": [
    {
      "url": "https://ecosystem.atlassian.net/browse/AW-20",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://jira.atlassian.com/browse/JRASERVER-72618",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://ecosystem.atlassian.net/browse/AW-20",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jira.atlassian.com/browse/JRASERVER-72618",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view whitelist rules via a Broken Access Control vulnerability in the /rest/whitelist/<version>/check endpoint. The affected versions are before version 8.13.3, and from version 8.14.0 before 8.14.1."
    },
    {
      "lang": "es",
      "value": "Unas versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos anónimos visualizar las reglas de la lista blanca por medio de una vulnerabilidad de Control de Acceso Roto en el endpoint /rest/whitelist/(versión)/check. Las versiones afectadas son anteriores a versión 8.13.3, y desde versión 8.14.0 hasta 8.14.1"
    }
  ],
  "lastModified": "2026-06-17T02:29:58.750",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09CBD196-0202-4A65-BC01-8DD009159343",
              "versionEndExcluding": "8.13.3"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:data_center:8:14:0:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75A45CB1-6D2C-4AEB-8C9A-830B92395052"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "121B25D7-31B4-4A85-BA57-5FE0DE58F4F4",
              "versionEndExcluding": "8.13.3"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira:8:14.0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "920C7B47-694F-46EF-8303-C4E13DF38C2F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@atlassian.com"
}