CVE-2020-36287

🗓️ 09 Apr 2021 02:00:14Reported by atlassianType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 151 Views🌐 WEB

Dashboard gadgets preference resource allows remote attackers to obtain settings

Reporter	Title	Published	Views	Family All 13
Atlassian	Anonymously accessible Dashboards can leak private information via configured gadgets - CVE-2020-36287	25 Mar 202103:53	–	atlassian
Atlassian	Anonymously accessible Dashboards can leak private information via configured gadgets - CVE-2020-36287	25 Mar 202103:53	–	atlassian
CNNVD	Atlassian JIRA Server和Atlassian JIRA Data Center 安全漏洞	8 Apr 202100:00	–	cnnvd
CNVD	Atlassian Jira Server and Jira Data Center have unspecified vulnerabilities	22 Apr 202100:00	–	cnvd
Check Point Advisories	Atlassian Jira Gadgets Plugin Authentication Bypass (CVE-2020-36287)	22 Sep 202100:00	–	checkpoint_advisories
Cvelist	CVE-2020-36287	9 Apr 202102:00	–	cvelist
GithubExploit	Exploit for Missing Authorization in Atlassian Data_Center	2 Aug 202101:52	–	githubexploit
NVD	CVE-2020-36287	9 Apr 202102:15	–	nvd
OSV	CVE-2020-36287	9 Apr 202102:15	–	osv
Prion	Open redirect	9 Apr 202102:15	–	prion

NVD

Node

atlassian data_centerRange<8.13.5

atlassian jiraRange<8.13.5

atlassian jira_data_centerRange8.14.0–8.15.1

atlassian jira_serverRange8.14.0–8.15.1

[
  {
    "product": "Jira Server",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "8.13.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.14.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.15.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Jira Data Center",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "8.13.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.14.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.15.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
jira	www.jira.atlassian.com/browse/JRASERVER-72258

Parameter	Position	Path	Description	CWE
ID	path	/rest/dashboards/1.0/10000/gadget/{ID}/prefs	POC endpoint for gadget preferences demonstrating how to access gadget settings without proper permissions.	CWE-862, CWE-863

21 Nov 2024 05:29Current

5Medium risk

Vulners AI Score5

CVSS 25

CVSS 3.15.3

EPSS0.62663