What’s Vulnerable › Vulnerabilities

CVE-2020-14177

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-09-21 · updated 2026-06-17

Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based Denial of Service (DoS) vulnerability in JQL version searching. The affected versions are before version 7.13.16; from version 7.14.0 before 8.5.7; from version 8.6.0 before 8.10.2; and from version 8.11.0 before 8.11.1.

Affected products

• Atlassian Jira: before 7.13.16; from 7.14.0 before 8.5.7; from 8.6.0 before 8.10.2; from 8.11.0 before 8.11.1 — fixed in 7.13.16, 8.10.2, 8.11.1, 8.5.7

How to fix

Upgrade to a fixed version: Atlassian Jira 7.13.16, 8.10.2, 8.11.1, 8.5.7. Check the vendor advisory for mitigations.

References

• https://jira.atlassian.com/browse/JRASERVER-71388
• https://jira.atlassian.com/browse/JRASERVER-71388

Get alerted when CVE-2020-14177 or the next vulnerability affects your stack