The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information via an Improper Authentication vulnerability: Workflow names; Project Key, if it is part of the workflow name; Issue Keys; Issue Types; Status Types. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 7.13.9 or 8.0.x < 8.4.2. It is, therefore, affected by multiple vulnerabilities:

- A Cross-Site Scripting (XSS) vulnerability in Issue Navigator Basic Search.

- A Improper Authentication vulnerability in the Convert Sub-Task, allowing remote attackers to enumerate Workflow names; Project Key, if it is part of the workflow name; Issue Keys; Issue Types and Status Types.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
113711	Atlassian Jira 8.0.x < 8.4.2 Multiple Vulnerabilties	Web App Scanning	Component Vulnerability	Version Based	medium
113710	Atlassian Jira < 7.13.9 Multiple Vulnerabilties	Web App Scanning	Component Vulnerability	Version Based	medium

Detections

Analytics

CVE-2019-20412

medium

Tenable Plugins

medium

medium