关联漏洞
标题：
Atlassian Jira 信息泄露漏洞
(CVE-2020-14179)
描述：Atlassian Jira是澳大利亚Atlassian公司的一套缺陷跟踪管理系统。该系统主要用于对工作中各类问题、缺陷进行跟踪管理。 Atlassian Jira 存在安全漏洞。该漏洞源于Jira Server and Data Center允许远程、未经身份验证的攻击者通过/secure/QueryComponent!Default中的一个信息泄露漏洞查看定制字段名和定制SLA名。以下是受影响的产品及版本：8.5.8版本之前，8.6.0版本至8.11.1版本。
描述
Sensitive data exposure via /secure/QueryComponent!Default.jspa endpoint - CVE-2020-14179
介绍
# CVE-2020-14179
Sensitive data exposure via `/secure/QueryComponent!Default.jspa` endpoint
- Priority: High
- Affects Version/s: 8.6.0 | 8.8.0 | 8.5.5 | 8.9.0 | 8.10.0 | 8.11.0
Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the `/secure/QueryComponent!Default.jspa` endpoint.
As my knowledge goes, 9.11.0, 9.7.1... also affected 😂
## Overview of [CVE-2020-14179_Finder.sh](https://github.com/mrnazu/CVE-2020-14179/blob/main/CVE-2020-14179_Finder.sh)
CVE-2020-14179 Finder is a simple bash script designed to check if a target is vulnerable to the `CVE-2020-14179`.
The script uses a specific HTTP request via `curl` to the `/secure/QueryComponent!Default.jspa` endpoint and analyzes the response to determine vulnerability.
## Features
- Sends a request to the specified endpoint `/secure/QueryComponent!Default.jspa`.
- Analyzes the response to determine vulnerability.
- Outputs color-coded results for easy identification.
- Stores request and response details in the "results" folder.
## Installation
1. Clone the repository:
- `git clone https://github.com/mrnazu/CVE-2020-14179.git`
2. Navigate to the script directory:
- `cd CVE-2020-14179`
3. Run the script:
- For a list of targets from a file: `./CVE-2020-14179_Finder.sh -l target.txt`
- For a single target URL: `./CVE-2020-14179_Finder.sh -u http://target.com/`
## Contributions
This script is provided for educational and research purposes only. Use it responsibly and only on systems you have permission to test.
文件快照
[4.0K] /data/pocs/de714c823cf2f6d923a358c2b0d80e00765012d9
├── [3.2K] CVE-2020-14179_Finder.sh
└── [1.7K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。