CVE-2020-36231

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an Insecure Direct Object References (IDOR) vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.2.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
AtlassianJira Server>= unspecified, < 8.5.10; >= 8.6.0, < unspecified; >= unspecified, < 8.13.2
AtlassianJira Data Center>= unspecified, < 8.5.10; >= 8.6.0, < unspecified; >= unspecified, < 8.13.2

References

Timeline

Published
Feb 2, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-362325.0The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from version 4.3.2.0 before 4CVE-2020-362337.8The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7CVE-2020-362344.8Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site ScCVE-2020-362355.3Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names CVE-2020-362366.1Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site ScCVE-2020-362375.3Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an InformCVE-2020-362385.3The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from vCVE-2020-362399.8Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 bCVE-2020-36247.8u'A potential buffer overflow exists due to integer overflow when parsing handler options due to wrong data type usage in operation' in SnapCVE-2020-362405.3The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote attaCVE-2020-362415.5autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal durCVE-2020-362429.1In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result