Description

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.

Remediation

References

CVE-2020-36289

Related Vulnerabilities

Magento Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2021-21016)

Jenkins Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability (CVE-2021-21615)

WordPress Plugin FireDrum Email Marketing PHP Object Injection (1.47)

PHP Numeric Errors Vulnerability (CVE-2011-1466)

WordPress Plugin Twitter LiveBlog Cross-Site Request Forgery (1.1.2)

Severity

Medium

Classification

CVE-2020-36289 CWE-200

Tags

Missing Update Known Vulnerabilities