nuclei-templates/http/cves/2020/CVE-2020-14181.yaml

47 lines
1.7 KiB
YAML

id: CVE-2020-14181
info:
name: Jira Server and Data Center - Information Disclosure
author: bjhulst
severity: medium
description: Jira Server and Data Center is susceptible to information disclosure. An attacker can enumerate users via the /ViewUserHover.jspa endpoint and thus potentially access sensitive information, modify data, and/or execute unauthorized operations. Affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.
remediation: |
Apply the necessary patches or updates provided by Atlassian to fix the vulnerability.
reference:
- https://jira.atlassian.com/browse/JRASERVER-71560
- http://packetstormsecurity.com/files/161730/Atlassian-JIRA-8.11.1-User-Enumeration.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-14181
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cve-id: CVE-2020-14181
cwe-id: CWE-200
epss-score: 0.96668
epss-percentile: 0.9954
cpe: cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: atlassian
product: data_center
shodan-query: http.component:"Atlassian Jira"
tags: cve,cve2020,atlassian,jira,packetstorm
http:
- method: GET
path:
- '{{BaseURL}}/secure/ViewUserHover.jspa'
matchers-condition: and
matchers:
- type: word
words:
- 'user-hover-details'
- 'content="JIRA"'
condition: and
- type: status
status:
- 200
# digest: 4b0a004830460221008fed5d528850a0ba1f75e3f386e9ef52bfbe0a1e727632c13c89155d7ae5e3bf0221009f77fa0b9de9af7cc449494ecb09edbb448616e064edaf362f81ba50ff44b19c:922c64590222798bb761d5b6d8e72950