8.16 - User Enumeration via /QueryComponentRendererValue!Default.jspa endpoint - CVE-2020-36289

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint.

This vulnerability was discovered by Mikhail Klyuchnikov of Positive Technologies.

The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.

 It is reported that this affects version 8.16

Affected versions:

• 8.16
• version < 8.5.13
• 8.6.0 ≤ version < 8.13.5
• 8.14.0 ≤ version < 8.15.1