CVE-2020-36288

MEDIUM

Jira Server and Data Center < 8.5.12, 8.6.0-8.13.4 - DOM Cross-Site Scripting via Parameter Pollution

Title source: llm

Description

The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.1 allows remote attackers to inject arbitrary HTML or JavaScript via a DOM Cross-Site Scripting (XSS) vulnerability caused by parameter pollution.

References (1)

Core 1

Core References

Third Party Advisory x_refsource_misc

https://jira.atlassian.com/browse/JRASERVER-72115

Scores

CVSS v3 6.1

EPSS 0.0066

EPSS Percentile 71.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (4)

atlassian/data_center < 8.5.12

atlassian/jira < 8.5.12

atlassian/jira_data_center 8.6.0 - 8.13.4

atlassian/jira_server 8.6.0 - 8.13.4

Published Apr 15, 2021

Tracked Since Feb 18, 2026