CVE-2020-36289
Estado: ModificadaMedia (5.3)—
Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Puntuación base: 5.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 99%
- Percentil entre todas las CVEs puntuadas: 100
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (4)
CWE
- CWE-863
- CWE-863
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2020-36289",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2020-36289",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-10-17T14:13:49.870839Z"
}
}
],
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 3.9
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "security@atlassian.com",
"affectedData": [
{
"vendor": "Atlassian",
"product": "Jira Server",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "8.5.13",
"versionType": "custom"
},
{
"status": "affected",
"version": "8.6.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "8.13.5",
"versionType": "custom"
},
{
"status": "affected",
"version": "8.14.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "8.15.1",
"versionType": "custom"
}
]
},
{
"vendor": "Atlassian",
"product": "Jira Data Center",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "8.5.13",
"versionType": "custom"
},
{
"status": "affected",
"version": "8.6.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "8.13.5",
"versionType": "custom"
},
{
"status": "affected",
"version": "8.14.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "8.15.1",
"versionType": "custom"
}
]
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"cpes": [
"cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*"
],
"vendor": "atlassian",
"product": "jira_data_center",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "8.5.15",
"versionType": "custom"
},
{
"status": "affected",
"version": "8.6.0",
"lessThan": "8.13.7",
"versionType": "custom"
},
{
"status": "affected",
"version": "8.14.0",
"lessThan": "8.17.0",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*"
],
"vendor": "atlassian",
"product": "jira_server",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "8.5.15",
"versionType": "custom"
},
{
"status": "affected",
"version": "8.6.0",
"lessThan": "8.13.7",
"versionType": "custom"
},
{
"status": "affected",
"version": "8.14.0",
"lessThan": "8.17.0",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2021-05-12T04:15:07.267",
"references": [
{
"url": "https://jira.atlassian.com/browse/JRASERVER-71559",
"tags": [
"Issue Tracking",
"Permissions Required",
"Vendor Advisory"
],
"source": "security@atlassian.com"
},
{
"url": "https://jira.atlassian.com/browse/JRASERVER-71559",
"tags": [
"Issue Tracking",
"Permissions Required",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-863"
}
]
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-863"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1."
},
{
"lang": "es",
"value": "Las versiones afectadas de Atlassian Jira Server y Data Center permiten a un usuario no autenticado enumerar usuarios a través de una vulnerabilidad de divulgación de información en el endpoint QueryComponentRendererValue!Default.jspa. Las versiones afectadas son anteriores a la versión 8.5.13, desde la versión 8.6.0 antes de la 8.13.5, y desde la versión 8.14.0 antes de la 8.15.1"
}
],
"lastModified": "2026-06-17T03:15:15.760",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A455FC63-AF29-4D31-8E11-AA5671D12E06",
"versionEndExcluding": "8.5.13"
},
{
"criteria": "cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA8144D6-FDAF-4B92-BE54-832893AC0A1E",
"versionEndExcluding": "8.5.13"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "26055208-F18D-4FF9-A442-7DD62D80F7E7",
"versionEndExcluding": "8.13.5",
"versionStartIncluding": "8.6.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9F4C4682-A56A-4BEA-AFD7-6F116FCE8EF9",
"versionEndExcluding": "8.15.1",
"versionStartIncluding": "8.14.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9DF55918-44C7-4DC9-BD66-9FD9BA64A955",
"versionEndExcluding": "8.13.5",
"versionStartIncluding": "8.6.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3C31DC16-F8E3-4261-B539-C251E4BBC584",
"versionEndExcluding": "8.15.1",
"versionStartIncluding": "8.14.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security@atlassian.com"
}