Authentication Vulnerability in Atlassian Jira Data Center Products

CVE-2020-36239

Summary

The vulnerability involves the exposure of the Ehcache RMI network service in several versions of Jira Data Center and related products. It allows attackers to execute arbitrary code by deserializing data sent over the network to the vulnerable Ehcache ports. Attackers capable of connecting to these ports can gain unauthorized access, potentially leading to significant compromises of Jira instances. Atlassian recommends that users restrict access to these ports and highlights that newer versions now require a shared secret for Ehcache service access to mitigate this security risk.

References