CVE-2020-36231

Published: Feb 2, 2021Modified: Nov 21, 2024

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an Insecure Direct Object References (IDOR) vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.2.

Affected (6)

Products: Atlassian: Jira, Jira Data Center, Jira Server, Jira Software Data Center

4 products

Jira Software Data Center

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Atlassian Jira	Before 8.5.10
Atlassian Jira Data Center	From 8.6.0 to 8.13.2
Atlassian Jira Data Center	Version 8.13.3
Atlassian Jira Server	From 8.6.0 to 8.13.2
Atlassian Jira Server	Version 8.13.3
Atlassian Jira Software Data Center	Before 8.5.10

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://jira.atlassian.com/browse/JRASERVER-72002

Source: security@atlassian.com

Issue TrackingVendor Advisory

https://jira.atlassian.com/browse/JRASERVER-72002

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.