Atlassian Jira Data Center
At a glance
- Source
- NVD
- EPSS
- EPSS 49.82 % · percentile 99 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- atlassian
- NVD status
- Modified
Description
Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service Management Data Center from version 2.0.2 before 4.5.16, from version 4.6.0 before 4.13.8, and from version 4.14.0 before 4.17.0 exposed a Ehcache RMI network service which attackers, who can connect to the service, on port 40001 and potentially 40011[0][1], could execute arbitrary code of their choice in Jira through deserialization due to a missing authentication vulnerability. While Atlassian strongly suggests restricting access to the Ehcache ports to only Data Center instances, fixed versions of Jira will now require a shared secret in order to allow access to the Ehcache service. [0] In Jira Data Center, Jira Core Data Center, and Jira Software Data Center versions prior to 7.13.1, the Ehcache object port can be randomly allocated. [1] In Jira Service Management Data Center versions prior to 3.16.1, the Ehcache object port can be randomly allocated.
Weaknesses (CWE)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2020-23784
- GCVE · GCVE-0-2020-36239
Affected configurations (NVD CPE)
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*≥ 6.3.0 < 8.5.16cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*≥ 8.6.0 < 8.13.8cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*≥ 8.14.0 < 8.17.0cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*≥ 2.0.2 < 4.5.16cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*≥ 4.6.0 < 4.13.8cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*≥ 4.14.0 < 4.17.0
Affected products
| Product | Versions |
|---|---|
| Atlassian · Jira Data Center | affected 6.3.0 < unspecified ; affected unspecified < 8.5.16 ; affected 8.6.0 < unspecified ; affected unspecified < 8.13.8 ; affected 8.14.0 < unspecified ; affected unspecified < 8.17.0 |
| Atlassian · Jira Core Data Center | affected 6.3.0 < unspecified ; affected unspecified < 8.5.16 ; affected 8.6.0 < unspecified ; affected unspecified < 8.13.8 ; affected 8.14.0 < unspecified ; affected unspecified < 8.17.0 |
| Atlassian · Jira Software Data Center | affected 6.3.0 < unspecified ; affected unspecified < 8.5.16 ; affected 8.6.0 < unspecified ; affected unspecified < 8.13.8 ; affected 8.14.0 < unspecified ; affected unspecified < 8.17.0 |
| Atlassian · Jira Service Management Data Center | affected 2.0.2 < unspecified ; affected unspecified < 4.5.16 ; affected 4.6.0 < unspecified ; affected unspecified < 4.13.8 ; affected 4.14.0 < unspecified ; affected unspecified < 4.17.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |