5.3
CVE-2020-36289
- EPSS 90.01%
- Veröffentlicht 12.05.2021 04:15:07
- Zuletzt bearbeitet 21.11.2024 05:29:13
- Quelle security@atlassian.com
- CVE-Watchlists
- Unerledigt
LoginAffected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Atlassian ≫ Data Center Version < 8.5.13
Atlassian ≫ Jira Data Center Version >= 8.6.0 < 8.13.5
Atlassian ≫ Jira Data Center Version >= 8.14.0 < 8.15.1
Atlassian ≫ Jira Server Version >= 8.6.0 < 8.13.5
Atlassian ≫ Jira Server Version >= 8.14.0 < 8.15.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 90.01% | 0.995 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:P/I:N/A:N
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
CWE-863 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.