CVE-2020-14165: 
JIRA vulnerability analysis and mitigation

The vulnerability (CVE-2020-14165) affects the UniversalAvatarResource.getAvatars resource in Jira Server and Data Center versions prior to 8.9.0. The vulnerability was discovered and reported on June 16, 2020, and was fixed in version 8.9.0. This security flaw allows remote attackers to obtain information about custom project avatars names through an improper authorization vulnerability (Atlassian Jira, CVE Mitre).

The vulnerability is classified as an improper authorization issue in the Project Administration component, specifically affecting the UniversalAvatarResource.getAvatars resource. The vulnerability has been assigned a CVSS 3.0 score of 10 (Critical) with attack vector parameters indicating low attack complexity, no user interaction required, and high impact on confidentiality (Manage Engine).

When exploited, this vulnerability enables remote attackers to access and obtain information about custom project avatars names, potentially exposing sensitive project-related information (Atlassian Jira).

The vulnerability requires no authentication and can be exploited remotely. As of the available information, no public exploits have been reported in the wild (Manage Engine).

The vulnerability has been fixed in Jira Server and Data Center version 8.9.0. Organizations using affected versions (< 8.9.0) should upgrade to version 8.9.0 or later to mitigate this security risk (Atlassian Jira).