CVE-2019-20412: 
JIRA vulnerability analysis and mitigation

The vulnerability (CVE-2019-20412) affects Atlassian Jira Server and Data Center's Convert Sub-Task to Issue page. The vulnerability was discovered and disclosed in early 2020, affecting versions before 7.13.9 and versions 8.0.0 to 8.4.2. This improper authentication vulnerability allows remote attackers to enumerate sensitive information from the system (Atlassian Jira, CVE Details).

The vulnerability is classified as an Improper Authentication issue with a CVSS 3.0 score of 10 (Critical) and CVSS 2.0 score of 7.5. The technical nature of the vulnerability allows unauthorized access to sensitive system information through the Convert Sub-Task to Issue page functionality (ManageEngine).

When exploited, the vulnerability allows attackers to enumerate several types of sensitive information including workflow names, project keys (if part of the workflow name), issue keys, issue types, and status types (Atlassian Jira).

The vulnerability can be exploited remotely by attackers without requiring authentication. No specific exploit details or reports of exploitation in the wild were publicly disclosed (NVD).

Atlassian has released fixes for this vulnerability in versions 7.13.9, 8.4.2, and 8.5.0. Users are advised to upgrade to these or later versions to mitigate the vulnerability (Atlassian Jira).