| Package | Affected versions | Patched versions |
|---|---|---|
| jira | < 7.13.12 | 7.13.12 |
| jira data center | = 8.6.0≥ 8.0.0, < 8.5.4 | 8.5.4 |
| jira server | = 8.6.0≥ 8.0.0, < 8.5.4 | 8.5.4 |
| jira software data center | < 7.13.12 | 7.13.12 |
Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free