### [CVE-2019-14995](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14995)
![](https://img.shields.io/static/v1?label=Product&message=Jira&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%208.4.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Authorization%20(CWE-863)&color=brighgreen)

### Description

The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is valid via a missing permissions check.

### POC

#### Reference
- https://jira.atlassian.com/browse/JRASERVER-69792
- https://jira.atlassian.com/browse/JRASERVER-69792
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0836
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0836
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0837
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0837

#### Github
No PoCs found on GitHub currently.