VulnerabilityModified
CVE-2020-36287
The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to obtain gadget related settings…
MEDIUM 5.3EPSS 8.95%
Does this matter?
Lower severity and a low EPSS score (8.95%). Track it; it rarely justifies an emergency change on its own.
Description
The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to obtain gadget related settings via a missing permissions check.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 8.95% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-863, CWE-862
- Affected
- atlassian/data center · atlassian/jira · atlassian/jira data center · atlassian/jira server
- Source
- security@atlassian.com
References
- https://jira.atlassian.com/browse/JRASERVER-72258Vendor Advisory
- https://jira.atlassian.com/browse/JRASERVER-72258Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.