Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-72531

8.16 - User Enumeration via /QueryComponentRendererValue!Default.jspa endpoint - CVE-2020-36289

XMLWordPrintable

      Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint.

      This vulnerability was discovered by Mikhail Klyuchnikov of Positive Technologies.

      The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.

       It is reported that this affects version 8.16

      Affected versions:

      • 8.16
      • version < 8.5.13
      • 8.6.0 ≤ version < 8.13.5
      • 8.14.0 ≤ version < 8.15.1

            Unassigned Unassigned
            mjohnson2@atlassian.com Mitchell Johnson
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated:
              Resolved: