CVE-2020-14180: 
Jira Service Management vulnerability analysis and mitigation

The vulnerability CVE-2020-14180 affects Atlassian Jira Service Desk Server and Data Center. The issue was discovered on July 1, 2020, and was resolved on August 26, 2020. This vulnerability allows remote attackers who are authenticated as non-administrator users to view Project Request-Types and Descriptions through an Information Disclosure vulnerability in the editform request-type-fields resource (Vendor Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and no user interaction. The vulnerability affects confidentiality but does not impact integrity or availability (NVD).

The primary impact of this vulnerability is the unauthorized disclosure of Project Request-Types and Descriptions to non-administrator users. This information disclosure could potentially reveal sensitive project information to users who should not have access to it (Vendor Advisory).

The vulnerability requires the attacker to be authenticated as a non-administrator user in the system. The attack vector is through the editform request-type-fields resource, making it exploitable over the network with low attack complexity (NVD).

The vulnerability has been fixed in Jira Service Desk Server and Data Center version 4.12.0. Organizations running affected versions (below 4.12.0) should upgrade to version 4.12.0 or later to mitigate this vulnerability (Vendor Advisory).