TI-2020-18584 Aliases CVE-2020-36286 GHSA-xmxv-mcf7-rf26

The membersOf JQL search function in Jira Server and Data Center before version 8.5.13…

LOW 27Published 2021-04-01 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a group exists & members of groups if they are assigned to publicly visible issue field.

Why it matters now

EPSS 0.01564 75th percentileScored 2026-11-07

Fix Fixed Jira Server (Atlassian): 8.5.13, 8.13.5, 8.15.1Jira Data Center (Atlassian): 8.5.13, 8.13.5, 8.15.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Atlassian	Jira Server	before 8.5.13; 8.6.0 and later; before 8.13.5; 8.14.0 and later; before 8.15.1	8.5.13, 8.13.5, 8.15.1	Patch available	CNA
Atlassian	Jira Data Center	before 8.5.13; 8.6.0 and later; before 8.13.5; 8.14.0 and later; before 8.15.1	8.5.13, 8.13.5, 8.15.1	Patch available	CNA

Jira Server VendorAtlassian Affected before 8.5.13; 8.6.0 and later; before 8.13.5; 8.14.0 and later; before 8.15.1 Fixed in 8.5.13, 8.13.5, 8.15.1 Patch available CNA
Jira Data Center VendorAtlassian Affected before 8.5.13; 8.6.0 and later; before 8.13.5; 8.14.0 and later; before 8.15.1 Fixed in 8.5.13, 8.13.5, 8.15.1 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:atlassian:data_center::::::::	before 8.5.13	Vulnerable	Atlassian
cpe:2.3:a:atlassian:jira::::::::	before 8.5.13	Vulnerable	Atlassian
cpe:2.3:a:atlassian:jira_data_center::::::::	8.6.0 to before 8.13.5; 8.14.0 to before 8.15.1	Vulnerable	Atlassian
cpe:2.3:a:atlassian:jira_server::::::::	8.6.0 to before 8.13.5; 8.14.0 to before 8.15.1	Vulnerable	Atlassian

cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:* Versions before 8.5.13 Vulnerable ·Atlassian
cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:* Versions before 8.5.13 Vulnerable ·Atlassian
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* Versions 8.6.0 to before 8.13.5; 8.14.0 to before 8.15.1 Vulnerable ·Atlassian
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* Versions 8.6.0 to before 8.13.5; 8.14.0 to before 8.15.1 Vulnerable ·Atlassian

Remediation

Fix · CNA Jira Server (Atlassian) Fixed in 8.5.13, 8.13.5, 8.15.1
Fix · CNA Jira Data Center (Atlassian) Fixed in 8.5.13, 8.13.5, 8.15.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2021-04-01
Atlassian Jira Data Center, Jira Server 8.13.5, 8.15.1 and 2 more versions
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2020-18558 Incorrect authorization in Atlassian Jira ServerPriority LOW 27
- TI-2021-08023 Cross-site request forgery in Atlassian Jira ServerPriority LOW 18
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2020-36286
2026-10-03 Alias added: GHSA-xmxv-mcf7-rf26

References

Advisory 1

https://jira.atlassian.com/browse/JRASERVER-72272

TI-2020-18587 Incorrect authorization in Atlassian Jira Server CVSS 3.1MEDIUM 5.3
TI-2020-11107 Information disclosure in Atlassian Jira Server CVSS 3.1MEDIUM 5.3
TI-2021-16503 Insufficient session expiration in Atlassian Jira Server CVSS 3.1HIGH 7.5
TI-2017-13320 Code injection in Atlassian Jira Server CVSS 3.1HIGH 8.8
TI-2020-17687 Path traversal in Atlassian Jira Server CVSS 3.1MEDIUM 5.3
TI-2021-16512 Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote… CVSS 3.1HIGH 7.5

See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences