Information disclosure in Login - CVE-2020-4028

Users without session information should be pushed to the login page.
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in Login.

Affected versions:

• version < 8.9.1

Fixed versions:

• 8.9.1
• 8.10.0
• 8.11.0

Notes:

If the fix is causing problems it can be disabled by adding to Jira a dark feature flag

jira.redirect.anonymous.404.errors.disabled

The fix is available in LTS versions - 7.13.15+ and 8.5.6+ but will be disabled. The fix can be enabled by adding to Jira a dark feature flag

jira.redirect.anonymous.404.errors.enabled

Both feature flags can be added by admin via site `<jira_directory>/secure/SiteDarkFeatures!default.jspa`