CVE-2019-8445

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote attackers to view worklog time information via a missing permissions check.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863 CWE-862

Affected software

Vendor	Product	Versions
Atlassian	Jira	>= unspecified, < 7.13.7; >= 8.0.0, < unspecified; >= unspecified, < 8.3.2

References

https://jira.atlassian.com/browse/JRASERVER-69778Vendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0840Third Party Advisory
https://jira.atlassian.com/browse/JRASERVER-69778Vendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0840Third Party Advisory

Timeline

Published: Aug 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-84465.3The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect author CVE-2019-84474.3The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site r CVE-2019-84485.3The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attackers to enumerate usern CVE-2019-84495.3The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information CVE-2019-84504.8Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attacke CVE-2019-84516.5The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal net CVE-2019-84527.8A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before CVE-2019-84535.5Some of the DLLs loaded by Check Point ZoneAlarm up to 15.4.062 are taken from directories where all users have write permissions. This can CVE-2019-84547.0A local attacker can create a hard-link between a file to which the Check Point Endpoint Security client for Windows before E80.96 writes an CVE-2019-84557.1A hard-link created from the log file of Check Point ZoneAlarm up to 15.4.062 to any file on the system will get its permission changed so t CVE-2019-84565.9Check Point IKEv2 IPsec VPN up to R80.30, in some less common conditions, may allow an attacker with knowledge of the internal configuration CVE-2019-84579.8SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree t