« Volver al listado

CVE-2020-14178

Estado: ModificadaAlta (7.5)—

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7, from version 8.0.0 before 8.5.8, and from version 8.6.0 before 8.12.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Atlassian — JiraAtlassian — Jira Data CenterAtlassian — Jira ServerAtlassian — Jira Software Data Center

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-14178",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@atlassian.com",
      "affectedData": [
        {
          "vendor": "Atlassian",
          "product": "Jira Server",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "7.13.17",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "8.0.0",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "8.5.8",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "8.6.0",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "8.12.0",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-09-01T05:15:10.063",
  "references": [
    {
      "url": "https://jira.atlassian.com/browse/JRASERVER-71498",
      "tags": [
        "Permissions Required"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://jira.atlassian.com/browse/JRASERVER-71498",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7, from version 8.0.0 before 8.5.8, and from version 8.6.0 before 8.12.0."
    },
    {
      "lang": "es",
      "value": "Las versiones afectadas de Atlassian Jira Server y Data Center permiten  a atacantes remotos enumerar las claves de proyecto por medio de una vulnerabilidad de Divulgación de Información en el endpoint /browse.PROJECTKEY. Las versiones afectadas son anteriores a versión 7.13.7, desde la versión 8.0.0 anteriores a 8.5.8 y desde la versión 8.6.0 anteriores a 8.12.0"
    }
  ],
  "lastModified": "2026-06-17T02:54:20.800",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34FEEA69-4B5F-4EDB-8007-F4918A8A4EDA",
              "versionEndExcluding": "7.13.7"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA8CC2B5-6238-4E5B-A7AC-34279A4FAF15",
              "versionEndExcluding": "8.5.8",
              "versionStartIncluding": "8.0.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4F4A10D-0C84-46C6-8428-A9B53541EB00",
              "versionEndExcluding": "8.12.0",
              "versionStartIncluding": "8.6.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B666569-FD4E-4C6B-9262-FE6D14F29C4F",
              "versionEndExcluding": "8.5.8",
              "versionStartIncluding": "8.0.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6D370E7-0939-40F3-942C-CA6D66B8AAC0",
              "versionEndExcluding": "8.12.0",
              "versionStartIncluding": "8.6.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_software_data_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45209CBE-8CDC-4D75-987D-95829E4DB999",
              "versionEndExcluding": "7.13.7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@atlassian.com"
}