CVE-2020-14181

🗓️ 17 Sep 2020 00:35:13Reported by atlassianType

cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 455 Views🌐 WEB

Atlassian Jira Server and Data Center unauthenticated user enumeration via Information Disclosur

Reporter	Title	Published	Views	Family All 26
0day.today	Atlassian JIRA 8.11.1 - User Enumeration Exploit	10 Mar 202100:00	–	zdt
GithubExploit	Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Atlassian Data_Center	26 Oct 202017:07	–	githubexploit
GithubExploit	Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Atlassian Data_Center	5 Feb 202107:48	–	githubexploit
ATTACKERKB	CVE-2020-14181	16 Sep 202000:00	–	attackerkb
Atlassian	Sensitive data exposure via /secure/QueryComponent!Default.jspa endpoint - CVE-2020-14179	10 Sep 202004:31	–	atlassian
Atlassian	User Enumeration via /ViewUserHover.jspa - CVE-2020-14181	16 Sep 202003:13	–	atlassian
Atlassian	User Enumeration via /ViewUserHover.jspa - CVE-2020-14181	16 Sep 202003:13	–	atlassian
BDU FSTEC	The vulnerability of the “/ViewUserHover.jspa” component in the Jira bug tracking system allows a hacker to expose user credentials.	20 Oct 202000:00	–	bdu_fstec
Circl	CVE-2020-14181	15 Sep 202117:55	–	circl
CNVD	Atlassian Jira Server and Data Center Information Disclosure Vulnerability (CNVD-2020-52933)	18 Sep 202000:00	–	cnvd

NVD

Node

atlassian data_centerRange<7.13.6

atlassian data_centerRange8.0.0–8.5.7

atlassian data_centerRange8.6.0–8.12.0

atlassian jiraRange<7.13.6

atlassian jira_serverRange8.0.0–8.5.7

atlassian jira_serverRange8.6.0–8.12.0

[
  {
    "product": "Jira Server",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "7.13.6",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.0.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.5.7",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.6.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.12.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/161730/Atlassian-JIRA-8.11.1-User-Enumeration.html
jira	www.jira.atlassian.com/browse/JRASERVER-71560

Parameter	Position	Path	Description	CWE
username	query param	/secure/ViewUserHover.jspa	Unauthenticated user can enumerate Jira users via ViewUserHover.jspa by supplying a username, enabling information disclosure.	CWE-200

17 Jun 2026 02:54Current

5.3Medium risk

Vulners AI Score5.3

CVSS 25

CVSS 3.15.3

EPSS0.99603