CVE-2019-20404

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper authorization vulnerability.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Feb 6, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-204054.3The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flaCVE-2019-204067.8The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.CVE-2019-204074.3The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackerCVE-2019-204085.3The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal netCVE-2019-204099.8The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gaCVE-2019-20417.3In the configuration of NFC modules on certain devices, there is a possible failure to distinguish individual devices due to an insecure defCVE-2019-204106.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information DisclosurCVE-2019-204114.3Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgCVE-2019-204125.3The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the folCVE-2019-204137.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of SCVE-2019-204145.4Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scCVE-2019-204154.3Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site
CVE-2019-20404: Medium severity, CVSS 4.3 | Vulnix