Description

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.

Remediation

References

CVE-2020-36289

Related Vulnerabilities

MySQL CVE-2017-10286 Vulnerability (CVE-2017-10286)

Joomla! Core 2.5.x Cross-Site Scripting (2.5.0 - 2.5.14)

Drupal Core 7.x Cross-Site Scripting (7.0 - 7.79)

WordPress Other Vulnerability (CVE-2007-3544)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-25603)

Severity

Medium

Classification

CVE-2020-36289 CWE-200

Tags

Missing Update Known Vulnerabilities