CVE-2020-14179

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from version 8.6.0 before 8.11.1.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
Atlassian	Jira Server	>= unspecified, < 8.5.8; >= 8.6.0, < unspecified; >= unspecified, < 8.11.1

References

https://jira.atlassian.com/browse/JRASERVER-71536Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/JRASERVER-71536Issue Tracking, Vendor Advisory

Timeline

Published: Sep 21, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-14187.8An elevation of privilege vulnerability exists when the Windows Diagnostics Execution Service fails to properly sanitize input, leading to a CVE-2020-141804.3Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to CVE-2020-141815.3Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vu CVE-2020-141834.3Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance's Support CVE-2020-141845.4Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vu CVE-2020-141855.3Affected versions of Jira Server allow remote unauthenticated attackers to enumerate issue keys via a missing permissions check in the Actio CVE-2020-141889.8The preprocessArgs function in the Atlassian gajira-create GitHub Action before version 2.0.1 allows remote attackers to execute arbitrary c CVE-2020-141899.8The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to execute arbitrary code CVE-2020-14195.5An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel In CVE-2020-141907.5Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. CVE-2020-141917.5Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS CVE-2020-141924.3Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerabili