CVE-2019-8445
MEDIUMJira Server 7.13.0-7.13.6 and 8.0.0-8.3.1 - Unauthenticated Worklog Information Disclosure via Missing Authorization
Title source: llmDescription
Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote attackers to view worklog time information via a missing permissions check.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_misc
https://jira.atlassian.com/browse/JRASERVER-69778
Third Party Advisory x_refsource_misc
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0840
Scores
CVSS v3
5.3
EPSS
0.0059
EPSS Percentile
69.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Details
CWE
CWE-862
CWE-863
Status
published
Products (1)
atlassian/jira_server
7.13.0 - 7.13.7
Published
Aug 23, 2019
Tracked Since
Feb 18, 2026