CVE-2020-36232: SSRF
First published: Mon Feb 22 2021(Updated: )
The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from version 4.3.2.0 before 4.3.2.4, from version 4.4.0 before 4.4.12, and from version 5.0.0 before 5.0.1 allowed unexpected DNS lookups and requests to arbitrary services as it incorrectly obtained application base url information from the executing http request which could be attacker controlled.
Credit: security@atlassian.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <4.2.37 | ||
| >=4.3.0<4.3.14 | ||
| >=4.3.2.0<4.3.2.4 | ||
| >=4.4.0<4.4.12 | ||
| >=5.0.0<5.0.1 | ||
| Atlassian Data Center | >=8.5.11<8.13.2 | |
| Atlassian Data Center | >=8.13.3<8.14.1 | |
| Atlassian Jira Data Center | =8.15.0 | |
| Atlassian Jira Server | >=8.5.11<8.13.2 | |
| Atlassian Jira Server | >=8.13.3<8.14.1 | |
| Atlassian Jira Server | =8.15.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-36232.
What is the severity of CVE-2020-36232?
The severity of CVE-2020-36232 is medium.
What software versions are affected by CVE-2020-36232?
The software versions affected by CVE-2020-36232 are: atlassian-gadgets versions before 4.2.37, from version 4.3.0 to version 4.3.14, from version 4.3.2.0 to version 4.3.2.4, from version 4.4.0 to version 4.4.12, and from version 5.0.0 to version 5.0.1.
What is the description of CVE-2020-36232?
CVE-2020-36232 is a vulnerability in the MessageBundleWhiteList class of atlassian-gadgets that allows unexpected DNS lookups and requests to arbitrary services.
How can I fix CVE-2020-36232?
To fix CVE-2020-36232, update the atlassian-gadgets software to version 4.2.37 or higher.
- collector/nvd-index
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/remedy
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/atlassian
- canonical/atlassian data center
- version/atlassian data center/8.5.11
- version/atlassian data center/8.13.3
- canonical/atlassian jira data center
- version/atlassian jira data center/8.15.0
- canonical/atlassian jira server
- version/atlassian jira server/8.5.11
- version/atlassian jira server/8.13.3
- version/atlassian jira server/8.15.0