CVE-2020-4028 Information disclosure in Jira Server and Data Center
Unauthenticated attackers can determine the existence of certain resources in Jira due to incorrect 404 responses instead of login redirects.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-4028?
CVE-2020-4028 is a medium-severity vulnerability in Atlassian Jira, published on 23 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in some situations this may have allowed unauthorised attackers to determine if certain resources exist or not through an Information Disclosure vulnerability.
Weakness: CWE-203
Which versions are affected by CVE-2020-4028?
It affects 2 products.
Products include Atlassian Jira, Atlassian Jira Software Data Center.
How do I fix CVE-2020-4028?
No fix has been published for CVE-2020-4028 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-4028 being exploited?
There is no known exploitation of CVE-2020-4028 in the wild and no public exploit code.
Other vulnerabilities in Atlassian Jira
Sources
Also known as GHSA-pvrh-7mfr-7cr8.