CVE-2020-36231

CWE-639 — Insecure Direct Object ReferenceCWE-20 — Improper Input Validation3 documents3 sources
Severity
4.3MEDIUM
EPSS
0.1%
top 66.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Atlassian Jira Data CenterAtlassian Jira ServerAtlassian Jira+1 more
Timeline
PublishedFeb 2
Latest updateMay 24

Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an Insecure Direct Object References (IDOR) vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages6 packages

▶CVEListV5atlassian/jira_data_centerunspecified — 8.5.10+2
▶NVDatlassian/jira_data_center8.6.0 — 8.13.2+1
▶CVEListV5atlassian/jira_serverunspecified — 8.5.10+2
▶NVDatlassian/jira_server8.6.0 — 8.13.2+1

🔴Vulnerability Details

2
GHSA
GHSA-972w-3xcp-6vcv: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an↗2022-05-24
▶
CVEList
CVE-2020-36231: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an↗2021-02-01
▶
CVE-2020-36231 (MEDIUM CVSS 4.3) | Affected versions of Atlassian Jira | cvebase.io