CVE-2020-14165

5.3 mediumEPSS 1.0%

Medium (5.3) in atlassian. EPSS 1.0% chance of exploitation in the next 30 days.

The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars names via an Improper authorization vulnerability.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
Published: 2020-07-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

atlassian:jira
atlassian:jira_software_data_center

References

https://jira.atlassian.com/browse/JRASERVER-71185
https://jira.atlassian.com/browse/JRASERVER-71185

Check your stack JSON