Vulnerability · Published May 12, 2021 · Assigned by atlassian

CVE-2020-36289

Medium 5.3

In plain English

A medium-severity incorrect authorization in Jira Data Center from Atlassian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 99.4% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)99.4%top 0.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.

Affected products (as reported)

Vendor	Product	Versions
Atlassian	Jira Server	unspecified – before 8.5.138.6.0 – before unspecifiedunspecified – before 8.13.58.14.0 – before unspecifiedunspecified – before 8.15.1
Atlassian	Jira Data Center	unspecified – before 8.5.138.6.0 – before unspecifiedunspecified – before 8.13.58.14.0 – before unspecifiedunspecified – before 8.15.1

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://jira.atlassian.com/browse/JRASERVER-71559 x_refsource_MISC