{"uuid": "c0771432-7d52-443a-a479-da1a532f3ab8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-36239", "type": "seen", "source": "https://t.me/hacking_Attack/17479", "content": "rsions\n* All 4.5.x versions before 4.5.16\n* All 4.6.x, 4.7.x, 4.8.x, 4.9.x, 4.10.x, 4.11.x, 4.12.x versions\n* All 4.13.x versions before 4.13.8\n* All 4.14.x, 4.15.x, 4.16.x versions\n\nAtlassian\u2019s advisory said that customers who have downloaded and installed any affected versions \u201cmust upgrade their installations immediately to fix this vulnerability.\u201d Having said that, Atlassian also noted that the \u201ccritical\u201d rating is its own assessment and that customers \u201cshould evaluate its applicability to your own IT environment.\u201d Non-Affected VersionsHere\u2019s the list of products that aren\u2019t affected by the flaw:\n\n* Atlassian Cloud\n* Jira Cloud\n* Jira Service Management Cloud\n* Non-Data Center instances of Jira Server (Core & Software) and Jira Service Management\n\nAlso, customers who have upgraded Jira Data Center, Jira Core Data Center, Jira Software Data Center to versions 8.5.16, 8.13.8, 8.17.0 and/or Jira Service Management Data Center to versions 4.5.16, 4.13.8 or 4.17.0 are off the hook: They don\u2019t need to upgrade.\n\nAtlassian \u201cstrongly suggests\u201d restricting access to the Ehcache ports to only Data Center instances, but noted that there\u2019s a caveat: \u201cFixed versions of Jira will now require a shared secret in order to allow access to the Ehcache service,\u201d according to the advisory. See Also: Offensive Security Tool: Veil Atlassian is Attacker CatnipSome of the largest enterprises with the most sophisticated product development use Atlassian products. Among its more than 65,000 users, Jira counts some big fans, including the likes of the Apache Software Foundation, Cisco, Fedora Commons, Hibernate, Pfizer and Visa.\n\nUnfortunately, its popularity \u2013 particularly with the big fish \u2013 and its capabilities make it a tempting target for attackers.\n\nIn June, researchers uncovered Atlassian bugs\u00a0that could have led to one-click takeover: A scenario that brought to mind the potential for an exploit that would have been similar to the SolarWinds\u00a0supply-chain attack, in which attackers used a default password as an open door into a software-updating mechanism.\n\nChris Morgan, senior cyber-threat intelligence analyst at digital-risk provider Digital Shadows, said that the vulnerability at the heart of Wednesday\u2019s advisory is just the latest in a series of bugs facing software engineering and management platforms that, if exploited, \u201ccould lead to a range of pernicious outcomes.\u201d\n\nWhile there\u2019s no evidence of active exploitation at this time, we can expect attempts to show up in the coming one to three months, Morgan predicted. \u201cCVE-2020-36239 can be remotely exploited to achieve arbitrary code execution and will likely be of great interest to both cybercriminals and nation-state-associated actors,\u201d he said. He pointed to several recent supply-chain attacks, including attacks against software providers Accellion\u00a0and Kaseya, that have leveraged vulnerabilities to gain initial access and to compromise software builds \u201cknown to be used by a diverse client base.\u201d\n\nOther security experts agreed with Morgan\u2019s assessment. Andrew Barratt, managing principal of solutions and investigations at cybersecurity advisory firm Coalfire, told Threatpost on Thursday that the vulnerability Atlassian disclosed on Wednesday \u201cshows that attackers are still looking to leverage economies of scale and compromise multiple parties using single platform-wide vulnerabilities.\u201d Expect Exploitation, In the Wild AttacksTL;DR: Apply the update ASAP, or implement Atlassian\u2019s workarounds, Morgan emphasized.\n\nThat said, the real impact depends on the exposure of the RMI APIs, Barratt suggested. \u201cThis could lead to targeted campaigns that focus on developers (historically who have lots of privileges and useful tools on their machines) that then seek to drop malware that exploits the Atlassian vulnerabilities for further manipulation of product development,\u201d he said.\n\nOn the optimistic side, the issue may blow[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:11.235123Z"}