Path traversal in Atlassian Jira Service Desk Server
Priority MEDIUM 42CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before version 3.9.16, from version 3.10.0 before version 3.16.8, from version 4.0.0 before version 4.1.3, from version 4.2.0 before version 4.2.5, from version 4.3.0 before version 4.3.4, and version 4.4.0 allows remote attackers with portal access to view arbitrary issues in Jira Service Desk projects via a path traversal vulnerability. Note that when the 'Anyone can email the service desk or raise a request in the portal' setting is enabled, an attacker can grant themselves portal access, allowing them to exploit the vulnerability.
Why it matters now
EPSS 0.05876 93rd percentileScored 2026-11-07
Fix Fixed Jira Service Desk Server (Atlassian): 3.9.16, 3.16.8, 4.1.3 +2Jira Service Desk Data Center (Atlassian): 3.9.16, 3.16.8, 4.1.3 +2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Atlassian | Jira Service Desk Server | before 3.9.16; 3.10.0 and later; before 3.16.8; 4.0.0 and later; before 4.1.3; 4.2.0 and later; before 4.2.5; 4.3.0 and later; before 4.3.4; 4.4.0 | 3.9.16, 3.16.8, 4.1.3, 4.2.5, 4.3.4 | Patch available | CNA |
| Atlassian | Jira Service Desk Data Center | before 3.9.16; 3.10.0 and later; before 3.16.8; 4.0.0 and later; before 4.1.3; 4.2.0 and later; before 4.2.5; 4.3.0 and later; before 4.3.4; 4.4.0 | 3.9.16, 3.16.8, 4.1.3, 4.2.5, 4.3.4 | Patch available | CNA |
- Jira Service Desk Server VendorAtlassian Affected before 3.9.16; 3.10.0 and later; before 3.16.8; 4.0.0 and later; before 4.1.3; 4.2.0 and later; before 4.2.5; 4.3.0 and later; before 4.3.4; 4.4.0 Fixed in 3.9.16, 3.16.8, 4.1.3, 4.2.5, 4.3.4 Patch available CNA
- Jira Service Desk Data Center VendorAtlassian Affected before 3.9.16; 3.10.0 and later; before 3.16.8; 4.0.0 and later; before 4.1.3; 4.2.0 and later; before 4.2.5; 4.3.0 and later; before 4.3.4; 4.4.0 Fixed in 3.9.16, 3.16.8, 4.1.3, 4.2.5, 4.3.4 Patch available CNA
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* | before 3.9.16 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:* | before 3.9.16 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* | 3.10.0 to before 3.16.8 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:* | 3.10.0 to before 3.16.8 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* | 4.0.0 to before 4.1.3 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:* | 4.0.0 to before 4.1.3 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* | 4.2.0 to before 4.2.5 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:* | 4.2.0 to before 4.2.5 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* | 4.3.0 to before 4.3.4 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:* | 4.3.0 to before 4.3.4 | Vulnerable | Atlassian |
- cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* Versions before 3.9.16 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:* Versions before 3.9.16 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* Versions 3.10.0 to before 3.16.8 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:* Versions 3.10.0 to before 3.16.8 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* Versions 4.0.0 to before 4.1.3 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:* Versions 4.0.0 to before 4.1.3 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* Versions 4.2.0 to before 4.2.5 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:* Versions 4.2.0 to before 4.2.5 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* Versions 4.3.0 to before 4.3.4 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:* Versions 4.3.0 to before 4.3.4 Vulnerable ·Atlassian
Remediation
- Fix · CNA Jira Service Desk Server (Atlassian) Fixed in 3.9.16, 3.16.8, 4.1.3, 4.2.5, 4.3.4
- Fix · CNA Jira Service Desk Data Center (Atlassian) Fixed in 3.9.16, 3.16.8, 4.1.3, 4.2.5, 4.3.4
Timeline
- 2026-10-02 Threatist record created from CVE-2019-14994
- 2026-10-03 Alias added: GHSA-3px6-x742-ffjj
References
Advisory 3
More Atlassian Jira Service Desk vulnerabilities
- TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
- TI-2020-18559 Missing authorization in Atlassian Jira Data Center CVSS 3.1CRITICAL 9.8
- TI-2022-09597 Server-side request forgery in Atlassian Jira Core Server CVSS 3.1MEDIUM 6.5
- TI-2022-09598 Improper authentication in Atlassian Bamboo Server CVSS 3.1CRITICAL 9.8
- TI-2022-09599 Origin validation error in Atlassian Bamboo Server CVSS 3.1HIGH 8.8
- TI-2021-16505 Code injection in Atlassian Jira Service Desk Server CVSS 3.1HIGH 7.2
Sources
- CVE-2019-14994 · CVE Program
- CVE-2019-14994 · NVD
- FIRST EPSS
- GHSA-3px6-x742-ffjj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences