SB2021072401 - Remote code execution in Jira Data Center and Jira Service Management Data Center

Description

This security bulletin contains information about 1 vulnerability.

1) Missing authentication for critical function (CVE-ID: CVE-2020-36239)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Red

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to missing authentication in the Ehcache RMI network service, listening on ports 40001/TCP and 40011/TCP. A remote non-authenticated attacker with ability to connect to the affected port can send a specially crafted request and execute arbitrary code on the system.

Successful exploitation of the vulnerability allows a remote attacker to compromise the affected system.

Remediation

Install update from vendor's website.

References

• https://confluence.atlassian.com/adminjiraserver/jira-data-center-and-jira-service-management-data-center-security-advisory-2021-07-21-1063571388.html
• https://jira.atlassian.com/browse/JRASERVER-72566?src=confmacro