CVE-2020-4028: Atlassian Jira

Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days.

Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in some situations this may have allowed unauthorised attackers to determine if certain resources exist or not through an Information Disclosure vulnerability.

Affected products

• Atlassian Jira: before 8.9.1 (fixed in 8.9.1)
• Atlassian Jira Software Data Center: before 8.9.1 (fixed in 8.9.1)

Published 2020-06-23. Last modified 2026-06-17.