description: Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings via a Broken Access Control vulnerability in the `ReplicationSettings!default.jspa` endpoint. The affected versions are before version 8.6.0, from version 8.7.0 before 8.13.12, and from version 8.14.0 before 8.20.1.
problem types: Improper Authorization (CWE-285)
affected:
{
product: Jira Server
vendor: Atlassian
versions:
lessThan: 8.6.0, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 8.7.0, versionType: custom
lessThan: 8.13.12, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 8.14.0, versionType: custom
lessThan: 8.20.1, status: affected, version: unspecified, versionType: custom
}
{
product: Jira Data Center
vendor: Atlassian
versions:
lessThan: 8.6.0, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 8.7.0, versionType: custom
lessThan: 8.13.12, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 8.14.0, versionType: custom
lessThan: 8.20.1, status: affected, version: unspecified, versionType: custom
}
