CVE-2020-36286
Summary
| CVE | CVE-2020-36286 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-04-01 03:15:00 UTC |
| Updated | 2022-03-30 13:29:00 UTC |
| Description | The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a group exists & members of groups if they are assigned to publicly visible issue field. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Atlassian | Data Center | All | All | All | All |
| Application | Atlassian | Jira | All | All | All | All |
| Application | Atlassian | Jira Data Center | All | All | All | All |
| Application | Atlassian | Jira Server | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [JRASERVER-72272] Information Disclosure using JQL function membersOf - CVE-2020-36286 - Create and track feature requests for Atlassian products. | N/A | jira.atlassian.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 730035 Atlassian Jira Server Information Disclosure Vulnerability(JRASERVER-72272)