Uploaded image for project: 'Jira Server and Data Center'
  1. Jira Server and Data Center
  2. JRASERVER-71559

User Enumeration via /QueryComponentRendererValue!Default.jspa endpoint - CVE-2020-36289

    XMLWordPrintable

Details

    Description

      Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint.

      This vulnerability was discovered by Mikhail Klyuchnikov of Positive Technologies.

      The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.

      Affected versions:

      • version < 8.5.15
      • 8.6.0 ≤ version < 8.13.7
      • 8.14.0 ≤ version < 8.17.0

      Fixed versions:

      • 8.5.15
      • 8.13.7
      • 8.17.0

      Note: this issue may also affect patched Jira instances if anonymous user access is enabled. For more information, refer to Atlassian's documentation on controlling anonymous user access.

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              ablack@atlassian.com Anton 🆎 (AU)
              Votes:
              1 Vote for this issue
              Watchers:
              16 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: