CVE-2020-36235

MEDIUM

Atlassian Jira < 8.13.2 and 8.14.0 < 8.14.1 - Unauthenticated Information Disclosure via Mobile Site View

Title source: llm
STIX 2.1

Description

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names via an Information Disclosure vulnerability in the mobile site view. The affected versions are before version 8.13.2, and from version 8.14.0 before 8.14.1.

References (1)

Core 1
Core References
Issue Tracking, Vendor Advisory x_refsource_misc
https://jira.atlassian.com/browse/JRASERVER-71950

Scores

CVSS v3 5.3
EPSS 0.0050
EPSS Percentile 66.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

Status published
Products (3)
atlassian/jira < 8.13.2
atlassian/jira_server 8.14.0 - 8.14.1
atlassian/jira_software_data_center < 8.13.2
Published Feb 15, 2021
Tracked Since Feb 18, 2026