PT-2024-4436 · Atlassian · Jira+1

Published 2024-05-14 · Updated 2024-06-20 · CVE-2024-21685

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jira Core Data Center versions 9.4.0 through 9.15.0 Jira Core Data Center version 9.12.0

Description The issue is related to insufficient protection of internal data in Atlassian Jira Data Center and Jira Server, allowing a remote attacker to gain unauthorized access to protected information. This Information Disclosure issue allows an unauthenticated attacker to view sensitive information, which has a high impact on confidentiality. The vulnerability was found internally and requires user interaction.

Recommendations For Jira Core Data Center 9.4: Upgrade to a release greater than or equal to 9.4.21 For Jira Core Data Center 9.12: Upgrade to a release greater than or equal to 9.12.8 For Jira Core Data Center 9.16: Upgrade to a release greater than or equal to 9.16.0 As a temporary workaround, consider restricting access to sensitive information until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2024-04938

CVE-2024-21685

Affected Products

Jira

Jira Core

References · 8

• https://osv.dev/vulnerability/CVE-2024-21685 · Vendor Advisory
• https://jira.atlassian.com/browse/JRASERVER-77713 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21685 · Security Note
• https://confluence.atlassian.com/pages/viewpage.action?pageId=1409286211 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04938 · Security Note
• https://cybersecurity-help.cz/vdb/SB20240618115 · Note
• https://t.me/cvenotify/83649 · Telegram Post
• https://confluence.atlassian.com/security/security-bulletin-june-18-2024-1409286211.html · Note