CVE-2020–14179 →Unauthenticated Jira Vulnerability
Who am I?
Security Researcher at HackerOne. In 2022, I was in 60th place worldwide as per HackerOne leaderboard. Check out the result from this link. You may follow me on Twitter to get some tips on Bug Bounty. My Twitter Handle: https://twitter.com/bughuntar
CVE-2020–14179:
Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from version 8.6.0 before 8.11.1.
Summary:
After picking up a wild domain I always scan the domain with Nuclei Security Vulnerability Scanner. I have done the same thing now and got CVE-2020–14179
Proof of Concept:
Exploit:
https://gjira.redacted.com/secure/QueryComponent!Default.jspaConclusion:
As I got it today I don’t know how many bounties I will get if it is accepted. Yet I am reciting Alhamdulillah as I am got it. Feel free to reach out to me on Twitter or another platform: always my username is “@bughuntar”.
