Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-72531

8.16 - User Enumeration via /QueryComponentRendererValue!Default.jspa endpoint - CVE-2020-36289

XMLWordPrintable

      Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint.

      This vulnerability was discovered by Mikhail Klyuchnikov of Positive Technologies.

      The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.

       It is reported that this affects version 8.16

      Affected versions:

      • 8.16
      • version < 8.5.13
      • 8.6.0 ≤ version < 8.13.5
      • 8.14.0 ≤ version < 8.15.1

              Unassigned Unassigned
              mjohnson2@atlassian.com Mitchell Johnson
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                Resolved: