CVE-2020-14168: Medium severity Atlassian Jira vulnerability

Q: What is CVE-2020-14168?

CVE-2020-14168 is a vulnerability in the email client of Jira Server and Data Center.

Q: How does CVE-2020-14168 affect Jira?

CVE-2020-14168 allows remote attackers to access outgoing emails between a Jira instance and the SMTP server via a man-in-the-middle (MITM) vulnerability.

Q: What versions of Jira are affected by CVE-2020-14168?

CVE-2020-14168 affects Jira Server and Data Center versions before 7.13.16, 8.5.0 to 8.5.7, 8.8.0 to 8.8.2, and 8.9.0 to 8.9.1.

Q: What is the severity of CVE-2020-14168?

CVE-2020-14168 has a severity rating of 5.9 (medium).

Q: Is there a fix for CVE-2020-14168?

Yes, upgrading Jira Server and Data Center to version 7.13.16, 8.5.7, 8.8.2, or 8.9.1 will fix CVE-2020-14168.

Published Jul 1, 2020

Updated

The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to access outgoing emails between a Jira instance and the SMTP server via man-in-the-middle (MITM) vulnerability.

Affected Software

8 affected components

Atlassian Jira<7.13.14

Atlassian Jira Data Center>=8.5.0<8.5.5

Atlassian Jira Data Center>=8.8.0<8.8.2

Atlassian Jira Data Center>=8.9.0<8.9.1

Atlassian Jira Server>=8.5.0<8.5.5

Atlassian Jira Server>=8.8.0<8.8.2

Atlassian Jira Server>=8.9.0<8.9.1

Atlassian Jira Software Data Center<7.13.14

Event History

Jul 1, 2020

CVE Published

via MITRE·01:35 AM

Data Sourced

via MITRE·01:35 AM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2020-14168?

CVE-2020-14168 is a vulnerability in the email client of Jira Server and Data Center.

How does CVE-2020-14168 affect Jira?

CVE-2020-14168 allows remote attackers to access outgoing emails between a Jira instance and the SMTP server via a man-in-the-middle (MITM) vulnerability.

What versions of Jira are affected by CVE-2020-14168?