← Back to browse · API

CVE-2020-36289

Severity
MEDIUM
CVSS
5.3
EPSS
0.99209
Risk score
55.92
CISA KEV
No
PoC
No
Published
2021-05-12
Modified
2024-10-17
First seen
2026-08-07
Aliases
EUVD-2020-23831, GHSA-JXV7-5F9P-6RG2
Products
Atlassian:Jira Data Center 8.14.0 <unspecified, Atlassian:Jira Data Center 8.6.0 <unspecified, Atlassian:Jira Data Center unspecified <8.13.5, Atlassian:Jira Data Center unspecified <8.15.1, Atlassian:Jira Data Center unspecified <8.5.13, Atlassian:Jira Server 8.14.0 <unspecified, Atlassian:Jira Server 8.6.0 <unspecified, Atlassian:Jira Server unspecified <8.13.5, Atlassian:Jira Server unspecified <8.15.1, Atlassian:Jira Server unspecified <8.5.13
Sources
euvd EUVD-2020-23831

Description

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.

References