The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0 before 8.8.1 allows remote attackers to enumerate project names via an improper authorization vulnerability.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.8.1. It is, therefore, affected by a flaw which permits remote attackers remote attackers to enumerate project names via an improper authorization vulnerability in the /rest/project-templates/1.0/createshared endpoint API endpoint.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.5, or version 8.6.x prior to 8.7.2, 8.8.x prior to 8.8.1. It is, therefore, affected by a Improper authorization vulnerability. It allow remote attackers to enumerate project names via an improper authorization vulnerability in the /rest/project-templates/1.0/createshared endpoint API endpoint.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
113743	Atlassian Jira 8.8.0 < 8.8.1 Improper Authorization On Createshared Endpoint	Web App Scanning	Component Vulnerability	medium
113742	Atlassian Jira 8.6.0 < 8.7.2 Improper Authorization On Createshared Endpoint	Web App Scanning	Component Vulnerability	medium
113741	Atlassian Jira 7.13 < 8.5.5 Improper Authorization On Createshared Endpoint	Web App Scanning	Component Vulnerability	medium
138880	Atlassian Jira < 8.5.5 / 8.6.x < 8.7.2 / 8.8.x < 8.8.1 Improper authorization	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2020-4029

medium

Tenable Plugins

medium

medium

medium

medium