CVE-2020-36231: Medium severity atlassian jira vulnerability

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2020-36231.

Q: How can remote attackers exploit this vulnerability?

Remote attackers can exploit this vulnerability to view the metadata of boards they should not have access to via an Insecure Direct Object References (IDOR) vulnerability.

Q: What is the severity of this vulnerability?

The severity of this vulnerability is medium, with a severity value of 4.3.

Q: How can I fix this vulnerability?

To fix this vulnerability, upgrade your Atlassian Jira Server or Data Center to version 8.5.10 or higher, or upgrade to version 8.13.2 or higher.

Published Feb 1, 2021

Updated

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an Insecure Direct Object References (IDOR) vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.2.

Affected Software

6 affected components

Atlassian Jira<8.5.10

Atlassian Jira Data Center>=8.6.0<8.13.2

Atlassian Jira Data Center=8.13.3

Atlassian Jira Server>=8.6.0<8.13.2

Atlassian Jira Server=8.13.3

Atlassian Jira Software Data Center<8.5.10

Event History

Feb 1, 2021

CVE Published

via MITRE·11:40 PM

Data Sourced

via MITRE·11:40 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2020-36231.

What versions of Atlassian Jira Server and Data Center are affected by this vulnerability?

Affected versions of Atlassian Jira Server and Data Center are before version 8.5.10, and from version 8.6.0 before 8.13.2.

How can remote attackers exploit this vulnerability?