Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-71559

User Enumeration via /QueryComponentRendererValue!Default.jspa endpoint - CVE-2020-36289


      Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint.

      This vulnerability was discovered by Mikhail Klyuchnikov of Positive Technologies.

      The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.

      Affected versions:

      • version < 8.5.15
      • 8.6.0 ≤ version < 8.13.7
      • 8.14.0 ≤ version < 8.17.0

      Fixed versions:

      • 8.5.15
      • 8.13.7
      • 8.17.0

      Note: this issue may also affect patched Jira instances if anonymous user access is enabled. For more information, refer to Atlassian's documentation on controlling anonymous user access.

            Unassigned Unassigned
            ablack@atlassian.com AB
            1 Vote for this issue
            17 Start watching this issue