CVE-2020-14178

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-09-01 · updated 2026-06-17

Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7, from version 8.0.0 before 8.5.8, and from version 8.6.0 before 8.12.0.

Affected products

Atlassian Jira: before 7.13.7 — fixed in 7.13.7
Atlassian Jira: from 8.0.0 before 8.5.8; from 8.6.0 before 8.12.0 — fixed in 8.12.0, 8.5.8
Atlassian Jira: from 8.0.0 before 8.5.8; from 8.6.0 before 8.12.0 — fixed in 8.12.0, 8.5.8
Atlassian Jira Software Data Center: before 7.13.7 — fixed in 7.13.7

How to fix

Upgrade to a fixed version: Atlassian Jira 7.13.7; Atlassian Jira 8.12.0, 8.5.8; Atlassian Jira 8.12.0, 8.5.8; Atlassian Jira Software Data Center 7.13.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-14178 or the next vulnerability affects your stack