Description
Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Atlassian | Jira Server | unspecified – < 8.5.13, 8.6.0 – < unspecified, unspecified – < 8.13.5, 8.14.0 – < unspecified, unspecified – < 8.15.1 | 8.5.13 |
| Atlassian | Jira Data Center | unspecified – < 8.5.13, 8.6.0 – < unspecified, unspecified – < 8.13.5, 8.14.0 – < unspecified, unspecified – < 8.15.1 | 8.5.13 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Jira Server and Data Center - Information Disclosure http/cves/2020/CVE-2020-36289.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.