{"id":"CVE-2020-36289","published":"2021-05-12T03:30:12Z","modified":"2024-10-17T14:27:07Z","title":"Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an…","vendor":"Atlassian","product":"Jira Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"Atlassian","product":"Jira Server","versions":[">= unspecified, < 8.5.13",">= 8.6.0, < unspecified",">= unspecified, < 8.13.5",">= 8.14.0, < unspecified",">= unspecified, < 8.15.1"]},{"vendor":"Atlassian","product":"Jira Data Center","versions":[">= unspecified, < 8.5.13",">= 8.6.0, < unspecified",">= unspecified, < 8.13.5",">= 8.14.0, < unspecified",">= unspecified, < 8.15.1"]}],"description":{"text":"Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.","provenance":"source","from":"CVE.org"},"summary":{"text":"An information disclosure flaw in the QueryComponentRendererValue!Default.jspa endpoint of Atlassian Jira Server and Data Center lets an attacker enumerate valid user accounts, caused by incorrect authorization. The attacker needs only network access to the affected Jira instance, with no authentication or user interaction required, and the flaw affects versions before 8.5.13, from 8.6.0 before 8.13.5, and from 8.14.0 before 8.15.1.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:30Z"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.99209,"percentile":0.99934,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"Proof Point Emerging Exploit list","url":"https://otx.alienvault.com/pulse/6399fdc966948f6b537b9762","created":"2022-12-14"}],"provenance":"machine"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://jira.atlassian.com/browse/JRASERVER-71559","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-23831","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-23831","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2020-36289","name":"Jira Server and Data Center - Information Disclosure","severity":"medium","path":"http/cves/2020/CVE-2020-36289.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36289.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-05-12","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-36289","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":29.4,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9993"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":3.71,"detail":"base score 5.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}