CVE-2020-36286

Published: Apr 1, 2021Modified: Nov 21, 2024

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a group exists & members of groups if they are assigned to publicly visible issue field.

Affected (6)

Products: Atlassian: Data Center, Jira, Jira Data Center, Jira Server

4 products

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Atlassian Data Center	Before 8.5.13
Atlassian Jira	Before 8.5.13
Atlassian Jira Data Center	From 8.14.0 to 8.15.1
Atlassian Jira Data Center	From 8.6.0 to 8.13.5
Atlassian Jira Server	From 8.14.0 to 8.15.1
Atlassian Jira Server	From 8.6.0 to 8.13.5

References (2)

https://jira.atlassian.com/browse/JRASERVER-72272

Source: security@atlassian.com

Vendor Advisory

https://jira.atlassian.com/browse/JRASERVER-72272

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.