{"api_version":"1","generated_at":"2026-07-23T09:42:31+00:00","cve":"CVE-2019-20407","urls":{"html":"https://cve.report/CVE-2019-20407","api":"https://cve.report/api/cve/CVE-2019-20407.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-20407","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-20407"},"summary":{"title":"CVE-2019-20407","description":"The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information in projects that they do not have access to through an missing authorisation check.","state":"PUBLIC","assigner":"security@atlassian.com","published_at":"2020-03-17 03:15:00","updated_at":"2022-03-30 13:21:00"},"problem_types":["CWE-862"],"metrics":[],"references":[{"url":"https://jira.atlassian.com/browse/JRASERVER-70599","name":"N/A","refsource":"N/A","tags":["Issue Tracking","Vendor Advisory"],"title":"[JRASERVER-70599] Information leak through broken access control in Jira Server and Data Center - CVE-2019-20407 - Create and track feature requests for Atlassian products.","mime":"text/html","httpstatus":"200","archivestatus":"426"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20407","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20407","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"20407","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"jira","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"20407","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"jira","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"20407","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"jira_data_center","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"20407","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"jira_server","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"20407","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"jira_software_data_center","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"20407","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"jira_software_data_center","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security@atlassian.com","DATE_PUBLIC":"2020-03-17T00:00:00","ID":"CVE-2019-20407","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Jira Software","version":{"version_data":[{"version_value":"8.6.1","version_affected":"<"}]}}]},"vendor_name":"Atlassian"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information in projects that they do not have access to through an missing authorisation check."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Improper Authorization"}]}]},"references":{"reference_data":[{"url":"https://jira.atlassian.com/browse/JRASERVER-70599","refsource":"MISC","name":"https://jira.atlassian.com/browse/JRASERVER-70599"}]}},"nvd":{"publishedDate":"2020-03-17 03:15:00","lastModifiedDate":"2022-03-30 13:21:00","problem_types":["CWE-862"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*","versionStartIncluding":"8.4.1","versionEndExcluding":"8.5.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*","versionStartIncluding":"8.6.2","versionEndExcluding":"8.7.0","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*","versionStartIncluding":"8.5.4","versionEndExcluding":"8.6.1","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*","versionStartIncluding":"8.4.1","versionEndExcluding":"8.5.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*","versionStartIncluding":"8.5.4","versionEndExcluding":"8.6.1","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*","versionStartExcluding":"8.6.2","versionEndExcluding":"8.7.0","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"20407","Ordinal":"168220","Title":"CVE-2019-20407","CVE":"CVE-2019-20407","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"20407","Ordinal":"1","NoteData":"The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information in projects that they do not have access to through an missing authorisation check.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"20407","Ordinal":"2","NoteData":"2020-03-16","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"20407","Ordinal":"3","NoteData":"2020-03-16","Type":"Other","Title":"Modified"}]}}}