Cloudanix VulnDB

CVE-2020-14179

Medium · 5.3

CVSS

5.3

EPSS

76.0%

Published

Sep 21, 2020

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Attend

A public flaw lets outsiders see hidden field names inside Jira without logging in, which can help them plan more damaging attacks.

Weaponized
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Trivial
Impact
Data Exposure
Component
Application
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unauthenticated remote access to the /secure/QueryComponent!Default.jspa endpoint returns custom field names and custom SLA names that should be restricted.

Why it matters to the business

Attackers can enumerate internal field structures, accelerating reconnaissance and targeted follow-on attacks against Jira instances that remain unpatched years after disclosure.

How an attack unfolds

An attacker sends an unauthenticated HTTP request to the exposed QueryComponent endpoint; the server responds with a list of custom field and SLA names that reveal application schema details usable for further exploitation. The flaw has been weaponized and maintains a high EPSS score with no decline over 30 days.

How to fix it

Upgrade Atlassian Jira Server and Data Center to version 8.5.8 or later, or to 8.11.1 or later. If immediate upgrade is not possible, restrict external access to the /secure/QueryComponent!Default.jspa endpoint via network controls or WAF rules.

How to confirm the fix worked

Confirm the endpoint returns HTTP 403 or a sanitized response for unauthenticated requests after applying the upgrade; re-test with the original unauthenticated request pattern to verify the information disclosure is closed.

Typical attack path

  1. Identify publicly reachable Jira Server or Data Center instance
  2. Issue GET request to /secure/QueryComponent!Default.jspa without credentials
  3. Parse response for custom field and SLA names
  4. Use discovered names to craft subsequent attacks or map sensitive data structures

How to detect it

Search web server and application logs for unauthenticated GET requests to /secure/QueryComponent!Default.jspa; look for responses containing lists of custom field or SLA names in the body.

  • /secure/QueryComponent!Default.jspa
  • QueryComponent!Default.jspa

What your security team should do

  • Prioritize patching to 8.5.8 or 8.11.1 within 30 days given weaponized exploit maturity and stable high EPSS
  • Add the QueryComponent endpoint to external-facing WAF rules as a compensating control
  • Review logs for repeated unauthenticated requests to the endpoint over the past 90 days
  • Inventory all internet-exposed Jira Server and Data Center instances for rapid remediation

The record

Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from version 8.6.0 before 8.11.1.

Affected packages

Ecosystem Package Introduced Fixed