Read the docs
TI-2024-14401 Aliases CVE-2024-21685GHSA-j6h8-65gx-v495

Information disclosure in Atlassian Jira Core Data Center

Priority LOW 31CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

This High severity Information Disclosure vulnerability was introduced in versions 9.4.0, 9.12.0, and 9.15.0 of Jira Core Data Center. This Information Disclosure vulnerability, with a CVSS Score of 7.4, allows an unauthenticated attacker to view sensitive information via an Information Disclosure vulnerability which has high impact to confidentiality, no impact to integrity, no impact to availability, and requires user interaction. Atlassian recommends that Jira Core Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Jira Core Data Center 9.4: Upgrade to a release greater than or equal to 9.4.21 Jira Core Data Center 9.12: Upgrade to a release greater than or equal to 9.12.8 Jira Core Data Center 9.16: Upgrade to a release greater than or equal to 9.16.0 See the release notes. You can download the latest version of Jira Core Data Center from the download center. This vulnerability was found internally.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00439 38th percentileScored 2026-11-07
Fix Fixed Jira Core Data Center (Atlassian): 9.16.0 to 9.16.1, 9.12.8 to 9.12.10, 9.4.21 to 9.4.23

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianJira Core Data Center9.12.0 to 9.12.7; 9.4.0 to 9.4.209.16.0 to 9.16.1, 9.12.8 to 9.12.10, 9.4.21 to 9.4.23Patch availableCNA
  • Jira Core Data Center VendorAtlassian Affected 9.12.0 to 9.12.7; 9.4.0 to 9.4.20 Fixed in 9.16.0 to 9.16.1, 9.12.8 to 9.12.10, 9.4.21 to 9.4.23 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*9.4.0 to before 9.4.21; 9.12.0 to before 9.12.8; 9.15.0 to before 9.16.0VulnerableAtlassian
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*9.4.0 to before 9.4.21; 9.12.0 to before 9.12.8VulnerableAtlassian
  • cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* Versions 9.4.0 to before 9.4.21; 9.12.0 to before 9.12.8; 9.15.0 to before 9.16.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* Versions 9.4.0 to before 9.4.21; 9.12.0 to before 9.12.8 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Jira Core Data Center (Atlassian) Fixed in 9.16.0 to 9.16.1, 9.12.8 to 9.12.10, 9.4.21 to 9.4.23

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-21685
  2. 2026-10-03 Alias added: GHSA-j6h8-65gx-v495

References

Advisory 2

  • TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
  • TI-2022-00460 Improper authentication in Atlassian Jira Core Server CVSS 3.1CRITICAL 9.8
  • TI-2024-14399 Code injection in Atlassian Confluence Data Center CVSS 3.1HIGH 8.8
  • TI-2021-08038 Path traversal in Atlassian Jira Server KEVCVSS 3.1MEDIUM 5.3
  • TI-2020-18559 Missing authorization in Atlassian Jira Data Center CVSS 3.1CRITICAL 9.8
  • TI-2020-18587 Incorrect authorization in Atlassian Jira Server CVSS 3.1MEDIUM 5.3
See all 79 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences