Read the docs
TI-2020-18559 Aliases CVE-2020-36239GHSA-2xhw-jfhh-p475

Missing authorization in Atlassian Jira Data Center

Priority HIGH 80CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-862.

Summary

Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service Management Data Center from version 2.0.2 before 4.5.16, from version 4.6.0 before 4.13.8, and from version 4.14.0 before 4.17.0 exposed a Ehcache RMI network service which attackers, who can connect to the service, on port 40001 and potentially 40011[0][1], could execute arbitrary code of their choice in Jira through deserialization due to a missing authentication vulnerability. While Atlassian strongly suggests restricting access to the Ehcache ports to only Data Center instances, fixed versions of Jira will now require a shared secret in order to allow access to the Ehcache service. [0] In Jira Data Center, Jira Core Data Center, and Jira Software Data Center versions prior to 7.13.1, the Ehcache object port can be randomly allocated. [1] In Jira Service Management Data Center versions prior to 3.16.1, the Ehcache object port can be randomly allocated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.49817 98th percentileScored 2026-11-07
Fix Fixed Jira Data Center (Atlassian): 8.5.16, 8.13.8, 8.17.0Jira Core Data Center (Atlassian): 8.5.16, 8.13.8, 8.17.0+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianJira Data Center6.3.0 and later; before 8.5.16; 8.6.0 and later; before 8.13.8; 8.14.0 and later; before 8.17.08.5.16, 8.13.8, 8.17.0Patch availableCNA
AtlassianJira Core Data Center6.3.0 and later; before 8.5.16; 8.6.0 and later; before 8.13.8; 8.14.0 and later; before 8.17.08.5.16, 8.13.8, 8.17.0Patch availableCNA
AtlassianJira Software Data Center6.3.0 and later; before 8.5.16; 8.6.0 and later; before 8.13.8; 8.14.0 and later; before 8.17.08.5.16, 8.13.8, 8.17.0Patch availableCNA
AtlassianJira Service Management Data Center2.0.2 and later; before 4.5.16; 4.6.0 and later; before 4.13.8; 4.14.0 and later; before 4.17.04.5.16, 4.13.8, 4.17.0Patch availableCNA
  • Jira Data Center VendorAtlassian Affected 6.3.0 and later; before 8.5.16; 8.6.0 and later; before 8.13.8; 8.14.0 and later; before 8.17.0 Fixed in 8.5.16, 8.13.8, 8.17.0 Patch available CNA
  • Jira Core Data Center VendorAtlassian Affected 6.3.0 and later; before 8.5.16; 8.6.0 and later; before 8.13.8; 8.14.0 and later; before 8.17.0 Fixed in 8.5.16, 8.13.8, 8.17.0 Patch available CNA
  • Jira Software Data Center VendorAtlassian Affected 6.3.0 and later; before 8.5.16; 8.6.0 and later; before 8.13.8; 8.14.0 and later; before 8.17.0 Fixed in 8.5.16, 8.13.8, 8.17.0 Patch available CNA
  • Jira Service Management Data Center VendorAtlassian Affected 2.0.2 and later; before 4.5.16; 4.6.0 and later; before 4.13.8; 4.14.0 and later; before 4.17.0 Fixed in 4.5.16, 4.13.8, 4.17.0 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*6.3.0 to before 8.5.16; 8.6.0 to before 8.13.8; 8.14.0 to before 8.17.0VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*2.0.2 to before 4.5.16; 4.6.0 to before 4.13.8VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*4.14.0 to before 4.17.0VulnerableAtlassian
  • cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* Versions 6.3.0 to before 8.5.16; 8.6.0 to before 8.13.8; 8.14.0 to before 8.17.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* Versions 2.0.2 to before 4.5.16; 4.6.0 to before 4.13.8 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* Versions 4.14.0 to before 4.17.0 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Jira Data Center (Atlassian) Fixed in 8.5.16, 8.13.8, 8.17.0
  • Fix · CNA Jira Core Data Center (Atlassian) Fixed in 8.5.16, 8.13.8, 8.17.0
  • Fix · CNA Jira Software Data Center (Atlassian) Fixed in 8.5.16, 8.13.8, 8.17.0
  • Fix · CNA Jira Service Management Data Center (Atlassian) Fixed in 4.5.16, 4.13.8, 4.17.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-36239
  2. 2026-10-03 Alias added: GHSA-2xhw-jfhh-p475

References

Patch 1

Advisory 2

  • TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
  • TI-2022-00460 Improper authentication in Atlassian Jira Core Server CVSS 3.1CRITICAL 9.8
  • TI-2024-14399 Code injection in Atlassian Confluence Data Center CVSS 3.1HIGH 8.8
  • TI-2021-08038 Path traversal in Atlassian Jira Server KEVCVSS 3.1MEDIUM 5.3
  • TI-2020-18587 Incorrect authorization in Atlassian Jira Server CVSS 3.1MEDIUM 5.3
  • TI-2022-09597 Server-side request forgery in Atlassian Jira Core Server CVSS 3.1MEDIUM 6.5
See all 79 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences