CVE-2020-14179: Atlassian Jira Server and Data Center information disclosure via QueryComponent endpoint

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityThe flaw is unauthenticated and remotely reachable with a very high EPSS score, but it only discloses limited configuration metadata and has no confirmed in-the-wild exploitation or KEV listing.

What it is

Jira Server and Data Center expose custom field names and custom SLA names through the /secure/QueryComponent!Default.jspa endpoint without requiring authentication. The flaw affects versions before 8.5.8 and 8.6.0 through 8.11.1, and it matters because it leaks internal configuration metadata to any remote user.

Impact

An unauthenticated attacker can read custom field names and custom SLA names, which may reveal internal workflows, service commitments, or naming conventions useful for further targeting. The direct impact is limited to information disclosure, not code execution or data modification.

Attack surface

The endpoint is reachable over the network via HTTP(S) and requires no authentication or user interaction, as reflected in the CVSS vector AV:N/AC:L/PR:N/UI:N. Any remote client that can reach the Jira instance can query it.

Exploitation

The record shows no CISA KEV listing and no ransomware association, but EPSS is very high at 0.76042 (99.5th percentile), indicating elevated predicted exploitation activity. The only references are vendor advisories, so no public exploit code is confirmed by this record.

What to do

• Upgrade Jira Server and Data Center to version 8.5.8 or later, or to 8.11.1 or later for the 8.6.0+ branch.
• If immediate upgrade is not possible, restrict network access to the /secure/QueryComponent!Default.jspa endpoint using a reverse proxy or WAF rule.
• Require authentication at the perimeter for Jira administrative and configuration endpoints where feasible.
• Monitor vendor advisories for backported fixes if you run an unsupported or pinned version.

Detection

• Search web access logs for requests to /secure/QueryComponent!Default.jspa, especially from unauthenticated or unexpected source IPs.
• Alert on high-volume or automated access to that endpoint from a single client.
• Correlate endpoint access with subsequent reconnaissance or enumeration activity against the Jira instance.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.