Select Page

Jira CVE-2024-21685 – Information Disclosure Corrective Action 

Jun 19, 2024 | Atlassian, Solving Problems

KithSolvingProblems

Jira CVE-2024-21685 Description and Immediate Mitigation Steps:

    • Severity: The critical vulnerability in Atlassian Jira Software Data Center, Atlassian Jira Service Management Data Center is classified as “HIGH”
    • Jira Software versions Impacted:
      • 9.12.0 to 9.12.7 (LTS)
      • 9.4.0 to 9.4.20 (LTS)
    • Jira Service Management versions Impacted:
      • 5.15.2
      • 5.12.0 to 5.12.7 (LTS)
      • 5.4.0 to 5.4.20 (LTS)
    • Vulnerability Type: Public Security Vulnerability
    • CVE Identifier: The specific vulnerability is tracked as CVE-2024-21685
    • CVSS Score: Atlassian assigned a CVSS score of 7.4 to this vulnerability, highlighting its severity.
    • Affected Products: Jira Software Data Center, Jira Serice Management Data Center
    • This vulnerability allows an unauthenticated attacker to view sensitive information via an Information Disclosure vulnerability which has high impact to confidentiality, no impact to integrity, no impact to availability, and requires user interaction

Recommended Actions:

    • Atlassian recommends that Jira Software Data Center and Server customers upgrade to one of the fix versions listed below
    • Jira Software fix versions:
      • 9.16.0 to 9.16.1 Data Center Only
      • 9.12.8 to 9.12.10 (LTS) recommended
      • 9.4.21 to 9.4.23 (LTS)
    • Jira Service Management fix versions:
      • 5.16.0 to 5.16.1 Data Center Only
      • 5.12.8 to 5.12.10 (LTS) recommended
      • 5.4.21 to 5.4.23 (LTS)

Standard Manual Upgrade Steps:

    • Notify users of outage for critical hotfixing
    • Stop services across all nodes
    • Backup existing database and shared home prior to upgrade
    • Make copies of the setenv.sh and server.xml found in the application install directories bin & conf (these hold critical settings we want to propogate again post upgrade
    • Download the hotfix from the Atlassian archives
    • Apply the upgrade, do not auto-start services
    • Copy back the setenv.sh, server.xml, and any other customized files you had to copy during the upgrade process
    • Restart services and perform smoke testing once Jira is available

 

Conclusion:

The advisory regarding the high Information Disclosure vulnerability, CVE-2024-21685, in Atlassian Jira Software Data Center, Jira Service Managment Data Center. With a CVSS score of 7.4 , this vulnerability poses a significant threat, allowing unauthenticated attackers to potentially compromise Jira Instances. 

To safeguard their systems and prevent the potential leakage of sensitive information and malicious attacks, all users are recommended to upgraded to latest versions. 

    Here is the notice from the National Vulnerability Database

    Link to Atlassian ticket can be found here. 

    Thanks for visiting, if you need assistance patching this vulnerability check out our Atlassian Services!