CVE-2020-14177
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based Denial of Service (DoS) vulnerability in JQL version searching.
Does this matter?
Lower severity and a low EPSS score (2.23%). Track it; it rarely justifies an emergency change on its own.
Description
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based Denial of Service (DoS) vulnerability in JQL version searching. The affected versions are before version 7.13.16; from version 7.14.0 before 8.5.7; from version 8.6.0 before 8.10.2; and from version 8.11.0 before 8.11.1.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 2.23% probability · 82th percentile
- CISA KEV
- Not listed
- Affected
- atlassian/jira server
- Source
- security@atlassian.com
References
- https://jira.atlassian.com/browse/JRASERVER-71388Vendor Advisory
- https://jira.atlassian.com/browse/JRASERVER-71388Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.