CVE-2020-36286

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a group exists & members of groups if they are assigned to publicly visible issue field.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Apr 1, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-362875.3The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, anCVE-2020-362886.1The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and froCVE-2020-362895.3Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vuCVE-2020-36297.8u'Stack out of bound issue occurs when making query to DSP capabilities due to wrong assumption was made on determining the buffer size for CVE-2020-362905.4The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 befoCVE-2020-36307.8Possibility of out of bound access while processing the responses from video firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon ConCVE-2020-363066.1Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field.CVE-2020-363076.1Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links.CVE-2020-363085.3Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and rCVE-2020-363095.3ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate CVE-2020-363105.5An issue was discovered in the Linux kernel before 5.8. arch/x86/kvm/svm/svm.c allows a set_memory_region_test infinite loop for certain nesCVE-2020-363115.5An issue was discovered in the Linux kernel before 5.9. arch/x86/kvm/svm/sev.c allows attackers to cause a denial of service (soft lockup) b
CVE-2020-36286: Medium severity, CVSS 5.3 | Vulnix