description: Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to view Project Request-Types and Descriptions, via an Information Disclosure vulnerability in the editform request-type-fields resource. The affected versions are before version 4.12.0.
problem types: Broken Access Control
affected:
{
product: Jira Service Desk Server
vendor: Atlassian
versions:
lessThan: 4.12.0, status: affected, version: unspecified, versionType: custom
}