CVE-2020-36238

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a username is valid or not via a missing permissions check.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863 CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Apr 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-362399.8Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 b CVE-2020-36247.8u'A potential buffer overflow exists due to integer overflow when parsing handler options due to wrong data type usage in operation' in Snap CVE-2020-362405.3The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote atta CVE-2020-362415.5autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal dur CVE-2020-362429.1In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result CVE-2020-362438.8The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php. To exploit the vulnera CVE-2020-362449.8The daemon in GENIVI diagnostic log and trace (DLT), is vulnerable to a heap-based buffer overflow that could allow an attacker to remotely CVE-2020-362458.8GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must b CVE-2020-362467.8Amaze File Manager before 3.5.1 allows attackers to obtain root privileges via shell metacharacters in a symbolic link.CVE-2020-362478.8Open OnDemand before 1.5.7 and 1.6.x before 1.6.22 allows CSRF.CVE-2020-362484.6The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and con CVE-2020-362497.5The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares.