PT-2021-11994 · Atlassian · Jira+1

Published 2021-04-09 · Updated 2022-09-20 · CVE-2020-36287

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Jira Server versions prior to 8.13.5 Jira Server versions 8.14.0 through 8.15.0 Jira Data Center versions prior to 8.13.5 Jira Data Center versions 8.14.0 through 8.15.0

Description: The issue allows remote anonymous attackers to obtain gadget related settings via a missing permissions check in the dashboard gadgets preference resource of the Atlassian gadgets plugin.

Recommendations: For Jira Server versions prior to 8.13.5, update to version 8.13.5 or later. For Jira Server versions 8.14.0 through 8.15.0, update to version 8.15.1 or later. For Jira Data Center versions prior to 8.13.5, update to version 8.13.5 or later. For Jira Data Center versions 8.14.0 through 8.15.0, update to version 8.15.1 or later.

Exploit

Fix

Incorrect Authorization

Missing Authorization

Weakness Enumeration

CWE-863

CWE-862

Related Identifiers

CVE-2020-36287

Affected Products

Gadgets Plugin

Jira

References · 6

• 🔥 https://github.com/f4rber/CVE-2020-36287 · Exploit
• https://osv.dev/vulnerability/CVE-2020-36287 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36287 · Security Note
• https://jira.atlassian.com/browse/JRASERVER-72258 · Vendor Advisory
• https://t.me/cvenotify/12981 · Telegram Post
• https://t.me/cvenotify/12982 · Telegram Post