What’s Vulnerable › Vulnerabilities
CVE-2020-4028
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.9% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-06-23 · updated 2026-06-17
- Weakness: CWE-203
Description
Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in some situations this may have allowed unauthorised attackers to determine if certain resources exist or not through an Information Disclosure vulnerability.
Affected products
- Atlassian Jira: before 8.9.1 — fixed in 8.9.1
- Atlassian Jira Software Data Center: before 8.9.1 — fixed in 8.9.1
How to fix
Upgrade to a fixed version: Atlassian Jira 8.9.1; Atlassian Jira Software Data Center 8.9.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2020-4028 or the next vulnerability affects your stack