FKIE_CVE-2020-36239

Vulnerability from fkie_nvd - Published: 2021-07-29 11:15 - Updated: 2024-11-21 05:29
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service Management Data Center from version 2.0.2 before 4.5.16, from version 4.6.0 before 4.13.8, and from version 4.14.0 before 4.17.0 exposed a Ehcache RMI network service which attackers, who can connect to the service, on port 40001 and potentially 40011[0][1], could execute arbitrary code of their choice in Jira through deserialization due to a missing authentication vulnerability. While Atlassian strongly suggests restricting access to the Ehcache ports to only Data Center instances, fixed versions of Jira will now require a shared secret in order to allow access to the Ehcache service. [0] In Jira Data Center, Jira Core Data Center, and Jira Software Data Center versions prior to 7.13.1, the Ehcache object port can be randomly allocated. [1] In Jira Service Management Data Center versions prior to 3.16.1, the Ehcache object port can be randomly allocated.
References
security@atlassian.comhttps://confluence.atlassian.com/adminjiraserver/jira-data-center-and-jira-service-management-data-center-security-advisory-2021-07-21-1063571388.htmlPatch, Vendor Advisory
security@atlassian.comhttps://jira.atlassian.com/browse/JRASERVER-72566Issue Tracking, Vendor Advisory
security@atlassian.comhttps://jira.atlassian.com/browse/JSDSERVER-8454Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://confluence.atlassian.com/adminjiraserver/jira-data-center-and-jira-service-management-data-center-security-advisory-2021-07-21-1063571388.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://jira.atlassian.com/browse/JRASERVER-72566Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://jira.atlassian.com/browse/JSDSERVER-8454Issue Tracking, Vendor Advisory
Impacted products
Vendor Product Version
atlassian jira_data_center *
atlassian jira_data_center *
atlassian jira_data_center *
atlassian jira_service_desk *
atlassian jira_service_desk *
atlassian jira_service_management *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "639EC886-D23E-4CF7-B729-731F3C4B3C10",
              "versionEndExcluding": "8.5.16",
              "versionStartIncluding": "6.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "20E7C6BB-8490-4C91-9DC2-6FB630125179",
              "versionEndExcluding": "8.13.8",
              "versionStartIncluding": "8.6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8B9DCF77-9D9D-4988-BEF3-14C9DAA43814",
              "versionEndExcluding": "8.17.0",
              "versionStartIncluding": "8.14.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*",
              "matchCriteriaId": "FB4FAD82-049D-449F-BA66-E3EB444D265A",
              "versionEndExcluding": "4.5.16",
              "versionStartIncluding": "2.0.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*",
              "matchCriteriaId": "8F5D807A-ADF1-405B-828C-B8F4ACB3D7B5",
              "versionEndExcluding": "4.13.8",
              "versionStartIncluding": "4.6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*",
              "matchCriteriaId": "76485A7B-A00D-407D-84A8-FEE959DB970C",
              "versionEndExcluding": "4.17.0",
              "versionStartIncluding": "4.14.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service Management Data Center from version 2.0.2 before 4.5.16, from version 4.6.0 before 4.13.8, and from version 4.14.0 before 4.17.0 exposed a Ehcache RMI network service which attackers, who can connect to the service, on port 40001 and potentially 40011[0][1], could execute arbitrary code of their choice in Jira through deserialization due to a missing authentication vulnerability. While Atlassian strongly suggests restricting access to the Ehcache ports to only Data Center instances, fixed versions of Jira will now require a shared secret in order to allow access to the Ehcache service. [0] In Jira Data Center, Jira Core Data Center, and Jira Software Data Center versions prior to 7.13.1, the Ehcache object port can be randomly allocated. [1] In Jira Service Management Data Center versions prior to 3.16.1, the Ehcache object port can be randomly allocated."
    },
    {
      "lang": "es",
      "value": "Jira Data Center, Jira Core Data Center, Jira Software Data Center desde la versi\u00f3n 6.3.0 antes de la versi\u00f3n 8.5.16, desde la versi\u00f3n 8.6.0 antes de la versi\u00f3n 8.13.8, desde la 8.14.0 antes de la versi\u00f3n 8.17.0 y Jira Service Management Data Center desde la versi\u00f3n 2.0.2 antes de la versi\u00f3n 4.5.16, desde la versi\u00f3n 4.6.0 antes de la versi\u00f3n 4.13.8, y desde la versi\u00f3n 4.14.0 antes de la versi\u00f3n  4.17.0 expusieron un servicio de red Ehcache RMI que los atacantes, que pueden conectarse al servicio, en el puerto 40001 y potencialmente 40011[0][1], podr\u00edan ejecutar c\u00f3digo arbitrario de su elecci\u00f3n en Jira a trav\u00e9s de la deserializaci\u00f3n debido a una vulnerabilidad de falta de autenticaci\u00f3n. Aunque Atlassian sugiere encarecidamente que se restrinja el acceso a los puertos Ehcache s\u00f3lo a las instancias del Centro de Datos, las versiones fijas de Jira requerir\u00e1n ahora un secreto compartido para permitir el acceso al servicio Ehcache. [0] En las versiones de Jira Data Center, Jira Core Data Center y Jira Software Data Center anteriores a la versi\u00f3n 7.13.1, el puerto del objeto Ehcache puede ser asignado aleatoriamente. [1] En las versiones de Jira Service Management Data Center anteriores a la versi\u00f3n 3.16.1, el puerto del objeto Ehcache puede asignarse aleatoriamente"
    }
  ],
  "id": "CVE-2020-36239",
  "lastModified": "2024-11-21T05:29:07.670",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2021-07-29T11:15:07.477",
  "references": [
    {
      "source": "security@atlassian.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://confluence.atlassian.com/adminjiraserver/jira-data-center-and-jira-service-management-data-center-security-advisory-2021-07-21-1063571388.html"
    },
    {
      "source": "security@atlassian.com",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://jira.atlassian.com/browse/JRASERVER-72566"
    },
    {
      "source": "security@atlassian.com",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://jira.atlassian.com/browse/JSDSERVER-8454"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://confluence.atlassian.com/adminjiraserver/jira-data-center-and-jira-service-management-data-center-security-advisory-2021-07-21-1063571388.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://jira.atlassian.com/browse/JRASERVER-72566"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://jira.atlassian.com/browse/JSDSERVER-8454"
    }
  ],
  "sourceIdentifier": "security@atlassian.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security@atlassian.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.