CVE-2020-36288

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.1 allows remote attackers to inject arbitrary HTML or JavaScript via a DOM Cross-Site Scripting (XSS) vulnerability caused by parameter pollution.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
AtlassianJira Server>= unspecified, < 8.5.12; >= 8.6.0, < unspecified; >= unspecified, < 8.13.4; >= 8.14.0, < unspecified; >= unspecified, < 8.15.1
AtlassianJira Data Center>= unspecified, < 8.5.12; >= 8.6.0, < unspecified; >= unspecified, < 8.13.4; >= 8.14.0, < unspecified; >= unspecified, < 8.15.1

References

Timeline

Published
Apr 15, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-362895.3Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vuCVE-2020-36297.8u'Stack out of bound issue occurs when making query to DSP capabilities due to wrong assumption was made on determining the buffer size for CVE-2020-362905.4The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 befoCVE-2020-36307.8Possibility of out of bound access while processing the responses from video firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon ConCVE-2020-363066.1Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field.CVE-2020-363076.1Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links.CVE-2020-363085.3Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and rCVE-2020-363095.3ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate CVE-2020-363105.5An issue was discovered in the Linux kernel before 5.8. arch/x86/kvm/svm/svm.c allows a set_memory_region_test infinite loop for certain nesCVE-2020-363115.5An issue was discovered in the Linux kernel before 5.9. arch/x86/kvm/svm/sev.c allows attackers to cause a denial of service (soft lockup) bCVE-2020-363125.5An issue was discovered in the Linux kernel before 5.8.10. virt/kvm/kvm_main.c has a kvm_io_bus_unregister_dev memory leak upon a kmalloc faCVE-2020-363137.8An issue was discovered in the Linux kernel before 5.7. The KVM subsystem allows out-of-range access to memslots after a deletion, aka CID-0
CVE-2020-36288: Medium severity, CVSS 6.1 | Vulnix