Skip to main content

Jira Data Center CVE-2024-21685

MEDIUM
Information Exposure (CWE-200)
2024-06-18 security@atlassian.com
Information Disclosure Atlassian Jira Data Center Jira Server
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Jun 18, 2024 - 17:15 nvd
MEDIUM 6.5

DescriptionNVD

This High severity Information Disclosure vulnerability was introduced in versions 9.4.0, 9.12.0, and 9.15.0 of Jira Core Data Center.

This Information Disclosure vulnerability, with a CVSS Score of 7.4, allows an unauthenticated attacker to view sensitive information via an Information Disclosure vulnerability which has high impact to confidentiality, no impact to integrity, no impact to availability, and requires user interaction.

Atlassian recommends that Jira Core Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:

Jira Core Data Center 9.4: Upgrade to a release greater than or equal to 9.4.21

Jira Core Data Center 9.12: Upgrade to a release greater than or equal to 9.12.8

Jira Core Data Center 9.16: Upgrade to a release greater than or equal to 9.16.0

See the release notes. You can download the latest version of Jira Core Data Center from the download center.

This vulnerability was found internally.

AnalysisAI

This High severity Information Disclosure vulnerability was introduced in versions 9.4.0, 9.12.0, and 9.15.0 of Jira Core Data Center. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. This High severity Information Disclosure vulnerability was introduced in versions 9.4.0, 9.12.0, and 9.15.0 of Jira Core Data Center. This Information Disclosure vulnerability, with a CVSS Score of 7.4, allows an unauthenticated attacker to view sensitive information via an Information Disclosure vulnerability which has high impact to confidentiality, no impact to integrity, no impact to availability, and requires user interaction. Atlassian recommends that Jira Core Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Jira Core Data Center 9.4: Upgrade to a release greater than or equal to 9.4.21 Jira Core Data Center 9.12: Upgrade to a release greater than or equal to 9.12.8 Jira Core Data Center 9.16: Upgrade to a release greater than or equal to 9.16.0 See the release notes. You can download the latest version of Jira Core Data Center from the download center. This vulnerability was found internally. Affected products include: Atlassian Jira Data Center, Atlassian Jira Server.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.

More in Jira Data Center

View all
CVE-2024-21683 HIGH POC
8.8 May 21

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and
CVE-2022-0540 CRITICAL POC
9.8 Apr 20

A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially
CVE-2022-26136 CRITICAL
9.8 Jul 20

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used

CVE-2021-26086 MEDIUM POC
5.3 Aug 16

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path tr
CVE-2020-14179 MEDIUM POC
5.3 Sep 21

Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field

CVE-2022-26137 HIGH
8.8 Jul 20

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Fil
CVE-2021-39113 HIGH
7.5 Aug 30

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached c
CVE-2020-14178 HIGH
7.5 Sep 01

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Infor
CVE-2020-14167 HIGH
7.5 Jul 01

The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from 8
CVE-2025-22157 HIGH
7.2 May 20

This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and

CVE-2022-36799 HIGH
7.2 Aug 01

This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has

CVE-2021-39128 HIGH
7.2 Sep 16

Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers

Same weakness CWE-200 – Information Exposure

View all
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8
CVE-2016-2388 MEDIUM POC
5.3
CVE-2016-1561 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2024-21685 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy