8.16 - User Enumeration via /QueryComponentRendererValue!Default.jspa endpoint - CVE-2020-36289

XMLWordPrintable

    • 5
    • 3
    • Severity 3 - Minor
    • 15

      Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint.

      This vulnerability was discovered by Mikhail Klyuchnikov of Positive Technologies.

      The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.

       It is reported that this affects version 8.16

      Affected versions:

      • 8.16
      • version < 8.5.13
      • 8.6.0 ≤ version < 8.13.5
      • 8.14.0 ≤ version < 8.15.1

            Assignee:
            Unassigned
            Reporter:
            Mitchell Johnson (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated:
              Resolved: