{"id":"CVE-2020-14179","published":"2020-09-21T00:50:12Z","modified":"2024-09-16T16:17:53Z","title":"Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom…","vendor":"Atlassian","product":"Jira Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"Atlassian","product":"Jira Server","versions":[">= unspecified, < 8.5.8",">= 8.6.0, < unspecified",">= unspecified, < 8.11.1"]}],"description":{"text":"Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from version 8.6.0 before 8.11.1.","provenance":"source","from":"CVE.org"},"summary":{"text":"An information disclosure flaw in the /secure/QueryComponent!Default.jspa endpoint of Atlassian Jira Server and Data Center lets an attacker view custom field names and custom SLA names. The attacker needs only remote network access to the endpoint, with no authentication or user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:18:35Z"},"cvss":null,"epss":{"score":0.76042,"percentile":0.99529,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://jira.atlassian.com/browse/JRASERVER-71536","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-6336","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-6336","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2021-01-08","earliestUrl":"https://github.com/c0brabaghdad1/CVE-2020-14179","repos":[{"name":"c0brabaghdad1/CVE-2020-14179","url":"https://github.com/c0brabaghdad1/CVE-2020-14179","stars":8,"created":"2021-01-08"},{"name":"mrnazu/CVE-2020-14179","url":"https://github.com/mrnazu/CVE-2020-14179","stars":4,"created":"2023-12-03"}]},"nuclei":[{"id":"CVE-2020-14179","name":"Atlassian Jira Server/Data Center <8.5.8/8.6.0 - 8.11.1 - Information Disclosure","severity":"medium","path":"http/cves/2020/CVE-2020-14179.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14179.yaml"}],"first":{"date":"2021-01-08","source":"PoC-in-GitHub","url":"https://github.com/c0brabaghdad1/CVE-2020-14179"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2020-09-21","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-14179","provenance":"source"},{"date":"2021-01-08","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/c0brabaghdad1/CVE-2020-14179","provenance":"source"}],"speed":{"daysToPublicExploit":109,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":24.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9953"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}