TI-2020-18558 Aliases CVE-2020-36238 GHSA-4f97-4vq5-662m

Incorrect authorization in Atlassian Jira Server

LOW 27CWE-863Published 2021-04-01 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.

Summary

The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a username is valid or not via a missing permissions check.

Why it matters now

EPSS 0.01704 77th percentileScored 2026-11-07

Fix Fixed Jira Server (Atlassian): 8.5.13, 8.13.5, 8.15.1Jira Data Center (Atlassian): 8.5.13, 8.13.5, 8.15.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Atlassian	Jira Server	before 8.5.13; 8.6.0 and later; before 8.13.5; 8.14.0 and later; before 8.15.1	8.5.13, 8.13.5, 8.15.1	Patch available	CNA
Atlassian	Jira Data Center	before 8.5.13; 8.6.0 and later; before 8.13.5; 8.14.0 and later; before 8.15.1	8.5.13, 8.13.5, 8.15.1	Patch available	CNA

Jira Server VendorAtlassian Affected before 8.5.13; 8.6.0 and later; before 8.13.5; 8.14.0 and later; before 8.15.1 Fixed in 8.5.13, 8.13.5, 8.15.1 Patch available CNA
Jira Data Center VendorAtlassian Affected before 8.5.13; 8.6.0 and later; before 8.13.5; 8.14.0 and later; before 8.15.1 Fixed in 8.5.13, 8.13.5, 8.15.1 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:atlassian:data_center::::::::	before 8.5.13	Vulnerable	Atlassian
cpe:2.3:a:atlassian:jira::::::::	before 8.5.13	Vulnerable	Atlassian
cpe:2.3:a:atlassian:jira_data_center::::::::	8.6.0 to before 8.13.5; 8.14.0 to before 8.15.1	Vulnerable	Atlassian
cpe:2.3:a:atlassian:jira_server::::::::	8.6.0 to before 8.13.5; 8.14.0 to before 8.15.1	Vulnerable	Atlassian

cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:* Versions before 8.5.13 Vulnerable ·Atlassian
cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:* Versions before 8.5.13 Vulnerable ·Atlassian
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* Versions 8.6.0 to before 8.13.5; 8.14.0 to before 8.15.1 Vulnerable ·Atlassian
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* Versions 8.6.0 to before 8.13.5; 8.14.0 to before 8.15.1 Vulnerable ·Atlassian

Remediation

Fix · CNA Jira Server (Atlassian) Fixed in 8.5.13, 8.13.5, 8.15.1
Fix · CNA Jira Data Center (Atlassian) Fixed in 8.5.13, 8.13.5, 8.15.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2021-04-01
Atlassian Jira Data Center, Jira Server 8.13.5, 8.15.1 and 2 more versions
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2020-18584 The membersOf JQL search function in Jira Server and Data Center before version 8.5.13…Priority LOW 27
- TI-2021-08023 Cross-site request forgery in Atlassian Jira ServerPriority LOW 18
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2020-36238
2026-10-03 Alias added: GHSA-4f97-4vq5-662m

References

Patch 1

https://jira.atlassian.com/browse/JRASERVER-72249

TI-2020-18587 Incorrect authorization in Atlassian Jira Server CVSS 3.1MEDIUM 5.3
TI-2020-11107 Information disclosure in Atlassian Jira Server CVSS 3.1MEDIUM 5.3
TI-2021-16503 Insufficient session expiration in Atlassian Jira Server CVSS 3.1HIGH 7.5
TI-2017-13320 Code injection in Atlassian Jira Server CVSS 3.1HIGH 8.8
TI-2020-17687 Path traversal in Atlassian Jira Server CVSS 3.1MEDIUM 5.3
TI-2021-16512 Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote… CVSS 3.1HIGH 7.5

See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences