Jira Server and Data Center - Information Disclosure

mediumseverity

5.3CVSS score

99.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Jira Server and Data Center is susceptible to information disclosure. An attacker can enumerate users via the /ViewUserHover.jspa endpoint and thus potentially access sensitive information, modify data, and/or execute unauthorized operations. Affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.

Impact

An attacker can gain access to sensitive information, potentially leading to further attacks.

Fix

Apply the necessary patches or updates provided by Atlassian to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/secure/ViewUserHover.jspa
Positive when: contains "user-hover-details" and "content=\"JIRA\"" AND status 200

Run it with nuclei: nuclei -id CVE-2020-14181 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-14181

info:
  name: Jira Server and Data Center - Information Disclosure
  author: bjhulst
  severity: medium
  description: Jira Server and Data Center is susceptible to information disclosure. An attacker can enumerate users via the /ViewUserHover.jspa endpoint and thus potentially access sensitive information, modify data, and/or execute unauthorized operations. Affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.
  impact: |
    An attacker can gain access to sensitive information, potentially leading to further attacks.
  remediation: |
    Apply the necessary patches or updates provided by Atlassian to fix the vulnerability.
  reference:
    - https://jira.atlassian.com/browse/JRASERVER-71560
    - http://packetstormsecurity.com/files/161730/Atlassian-JIRA-8.11.1-User-Enumeration.html
    - https://nvd.nist.gov/vuln/detail/CVE-2020-14181
    - https://github.com/H4ckTh3W0r1d/Goby_POC
    - https://github.com/Rival420/CVE-2020-14181
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2020-14181
    cwe-id: CWE-200
    epss-score: 0.99686
    epss-percentile: 0.99951
    cpe: cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: atlassian
    product: data_center
    shodan-query:
      - http.component:"Atlassian Jira"
      - http.component:"atlassian jira"
  tags: cve,cve2020,atlassian,jira,packetstorm,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/secure/ViewUserHover.jspa'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'user-hover-details'
          - 'content="JIRA"'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from