CVEs-PoC/2019/CVE-2019-14995.md

CVE-2019-14995

Description

The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is valid via a missing permissions check.

POC

Reference

• https://jira.atlassian.com/browse/JRASERVER-69792
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0836
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0837

Github

• https://github.com/20142995/nuclei-templates
• https://github.com/cyb3r-w0lf/nuclei-template-collection