Vulnerability · Published Feb 22, 2021 · Assigned by atlassian
CVE-2020-36232
Medium 5.0
In plain English
A medium-severity security flaw in Atlassian Gadgets from Atlassian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).
Severity (CVSS NVD)5.0Medium
Exploit odds (30 days)1.1%top 34.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from version 4.3.2.0 before 4.3.2.4, from version 4.4.0 before 4.4.12, and from version 5.0.0 before 5.0.1 allowed unexpected DNS lookups and requests to arbitrary services as it incorrectly obtained application base url information from the executing http request which could be attacker controlled.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Atlassian Gadgets | unspecified – before 4.2.374.3.0 – before unspecifiedunspecified – before 4.3.144.3.2.0 – before unspecifiedunspecified – before 4.3.2.44.4.0 – before unspecifiedunspecified – before 4.4.125.0.0 |
References
- https://jira.atlassian.com/browse/JRASERVER-72025 x_refsource_MISC