« Volver al listado

CVE-2019-20899

Estado: ModificadaMedia (5.3)—

The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the Gadget API. The affected versions are before version 8.5.4, and from version 8.6.0 before 8.6.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Atlassian — JiraAtlassian — Jira Data CenterAtlassian — Jira ServerAtlassian — Jira Software Data Center

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-20899",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@atlassian.com",
      "affectedData": [
        {
          "vendor": "Atlassian",
          "product": "Jira Server",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "8.5.4",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "8.6.0",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "8.6.1",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-07-13T01:15:13.433",
  "references": [
    {
      "url": "https://jira.atlassian.com/browse/JRASERVER-70808",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://jira.atlassian.com/browse/JRASERVER-70808",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the Gadget API. The affected versions are before version 8.5.4, and from version 8.6.0 before 8.6.1."
    },
    {
      "lang": "es",
      "value": "La API Gadget en Atlassian Jira Server y Data Center en las versiones afectadas permite a atacantes remotos hacer que Jira no responda por medio de peticiones repetidas a un determinado endpoint en la API Gadget. Las versiones afectadas son anteriores a versión 8.5.4 y desde versión 8.6.0 anteriores a 8.6.1"
    }
  ],
  "lastModified": "2026-06-17T02:31:24.247",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1BD552E1-A564-434E-905A-380A9B1A090B",
              "versionEndExcluding": "8.5.4"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7DEE45D0-B55A-4A06-BAF0-18A7E3D26DE4",
              "versionEndExcluding": "8.6.1",
              "versionStartIncluding": "8.5.5"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0B1BE966-205E-4CA3-A799-8B1754D10B27",
              "versionEndExcluding": "8.7.0",
              "versionStartIncluding": "8.6.2"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02D4E59C-FFFF-4545-A5A1-DA5DB091B846",
              "versionEndExcluding": "8.6.1",
              "versionStartIncluding": "8.5.5"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1884A441-8487-40FF-AEE3-E025670C0723",
              "versionEndExcluding": "8.7.0",
              "versionStartIncluding": "8.6.2"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_software_data_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F9839F36-EBE8-4992-8AAA-234D352292AC",
              "versionEndExcluding": "8.5.4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@atlassian.com"
}