$ cve CVE-2020-36239 JSON

CVE-2020-36239

9.8

CRITICAL · CVSS 3.1 · EPSS 49.8% (pctl 99)

Patch early

EPSS 49.8% — above the 10% action threshold.

Description

Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service Management Data Center from version 2.0.2 before 4.5.16, from version 4.6.0 before 4.13.8, and from version 4.14.0 before 4.17.0 exposed a Ehcache RMI network service which attackers, who can connect to the service, on port 40001 and potentially 40011[0][1], could execute arbitrary code of their choice in Jira through deserialization due to a missing authentication vulnerability. While Atlassian strongly suggests restricting access to the Ehcache ports to only Data Center instances, fixed versions of Jira will now require a shared secret in order to allow access to the Ehcache service. [0] In Jira Data Center, Jira Core Data Center, and Jira Software Data Center versions prior to 7.13.1, the Ehcache object port can be randomly allocated. [1] In Jira Service Management Data Center versions prior to 3.16.1, the Ehcache object port can be randomly allocated.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	49.82% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-862
On CISA KEV	no
Public exploit	none known
Published	2021-07-29
Last modified	2026-06-17

Affected (3)

Vendor	Product
atlassian	jira data center
atlassian	jira service desk
atlassian	jira service management

References

→ the Explorer · watch your stack · NVD