Read the docs
TI-2019-14638 Aliases CVE-2019-20404GHSA-8m4x-phmq-q73v

The API in Atlassian Jira Server and Data Center before version 8.6.0 allows…

Priority LOW 23Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper authorization vulnerability.

Why it matters now

EPSS 0.01297 70th percentileScored 2026-11-07
Fix Fixed Jira Server (Atlassian): 8.6.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianJira Serverbefore 8.6.08.6.0Patch availableCNA
  • Jira Server VendorAtlassian Affected before 8.6.0 Fixed in 8.6.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*8.2.4 to before 8.6.0; 8.6.1 to before 8.7.0VulnerableAtlassian
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*8.2.4 to before 8.6.0; 8.6.1 to before 8.7.0VulnerableAtlassian
  • cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* Versions 8.2.4 to before 8.6.0; 8.6.1 to before 8.7.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* Versions 8.2.4 to before 8.6.0; 8.6.1 to before 8.7.0 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Jira Server (Atlassian) Fixed in 8.6.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Atlassian Jira Server 8.6.0

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2019-14637 The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote…Priority LOW 27
    • TI-2019-14636 Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be…Priority LOW 24
    • TI-2019-14639 Cross-site request forgery in Atlassian Jira ServerPriority LOW 21
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-20404
  2. 2026-10-03 Alias added: GHSA-8m4x-phmq-q73v

References

Advisory 1

  • TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
  • TI-2022-00460 Improper authentication in Atlassian Jira Core Server CVSS 3.1CRITICAL 9.8
  • TI-2024-14399 Code injection in Atlassian Confluence Data Center CVSS 3.1HIGH 8.8
  • TI-2021-08038 Path traversal in Atlassian Jira Server KEVCVSS 3.1MEDIUM 5.3
  • TI-2020-18559 Missing authorization in Atlassian Jira Data Center CVSS 3.1CRITICAL 9.8
  • TI-2020-18587 Incorrect authorization in Atlassian Jira Server CVSS 3.1MEDIUM 5.3
See all 79 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences