What’s Vulnerable › Vulnerabilities

CVE-2019-20106

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-02-06 · updated 2026-06-17
• Weakness: CWE-276

Description

Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug.

Affected products

• Atlassian Jira: before 7.13.12 — fixed in 7.13.12
• Atlassian Jira: from 8.0.0 before 8.5.4; 8.6.0 — fixed in 8.5.4
• Atlassian Jira: from 8.0.0 before 8.5.4; 8.6.0 — fixed in 8.5.4
• Atlassian Jira Software Data Center: before 7.13.12 — fixed in 7.13.12

How to fix

Upgrade to a fixed version: Atlassian Jira 7.13.12; Atlassian Jira 8.5.4; Atlassian Jira 8.5.4; Atlassian Jira Software Data Center 7.13.12. Check the vendor advisory for mitigations.

References

• https://jira.atlassian.com/browse/JRASERVER-70543
• https://jira.atlassian.com/browse/JRASERVER-70543

Get alerted when CVE-2019-20106 or the next vulnerability affects your stack