mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-07-30 18:04:30 +00:00
Add CVE-2019-15003 CVE-2019-15004
This commit is contained in:
David Black
parent
0fd9f98fd7
commit
d64157aeed
153
2019/15xxx/CVE-2019-15003.json
Normal file
153
2019/15xxx/CVE-2019-15003.json
Normal file
@ -0,0 +1,153 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "security@atlassian.com",
|
||||
"DATE_PUBLIC": "2019-11-07T00:00:00",
|
||||
"ID": "CVE-2019-15003",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Jira Service Desk Server",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "3.9.17",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "3.10.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "3.16.10",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "4.0.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "4.2.6",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "4.3.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "4.3.5",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "4.4.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "4.4.3",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "4.5.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "4.5.1",
|
||||
"version_affected": "<"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "Jira Service Desk Data Center",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "3.9.17",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "3.10.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "3.16.10",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "4.0.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "4.2.6",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "4.3.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "4.3.5",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "4.4.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "4.4.3",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "4.5.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "4.5.1",
|
||||
"version_affected": "<"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Atlassian"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 allows remote attackers with portal access to view arbitrary issues in Jira Service Desk projects via authorization bypass. Note that when the 'Anyone can email the service desk or raise a request in the portal' setting is enabled, an attacker can grant themselves portal access, allowing them to exploit the vulnerability."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Authorization Bypass"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://jira.atlassian.com/browse/JSDSERVER-6590"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
153
2019/15xxx/CVE-2019-15004.json
Normal file
153
2019/15xxx/CVE-2019-15004.json
Normal file
@ -0,0 +1,153 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "security@atlassian.com",
|
||||
"DATE_PUBLIC": "2019-11-07T00:00:00",
|
||||
"ID": "CVE-2019-15004",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Jira Service Desk Server",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "3.9.17",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "3.10.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "3.16.10",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "4.0.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "4.2.6",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "4.3.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "4.3.5",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "4.4.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "4.4.3",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "4.5.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "4.5.1",
|
||||
"version_affected": "<"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "Jira Service Desk Data Center",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "3.9.17",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "3.10.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "3.16.10",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "4.0.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "4.2.6",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "4.3.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "4.3.5",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "4.4.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "4.4.3",
|
||||
"version_affected": "<"
|
||||
},
|
||||
{
|
||||
"version_value": "4.5.0",
|
||||
"version_affected": ">="
|
||||
},
|
||||
{
|
||||
"version_value": "4.5.1",
|
||||
"version_affected": "<"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Atlassian"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 allows remote attackers with portal access to view arbitrary issues in Jira Service Desk projects via a path traversal vulnerability. Note that when the 'Anyone can email the service desk or raise a request in the portal' setting is enabled, an attacker can grant themselves portal access, allowing them to exploit the vulnerability."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Path Traversal"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://jira.atlassian.com/browse/JSDSERVER-6589"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user