Vulnerability Description
The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from version 4.3.2.0 before 4.3.2.4, from version 4.4.0 before 4.4.12, and from version 5.0.0 before 5.0.1 allowed unexpected DNS lookups and requests to arbitrary services as it incorrectly obtained application base url information from the executing http request which could be attacker controlled.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Atlassian-Gadgets | < 4.2.37 |
| Atlassian | Data Center | >= 8.5.11, < 8.13.2 |
| Atlassian | Jira Data Center | 8.15.0 |
| Atlassian | Jira Server | >= 8.5.11, < 8.13.2 |
Related Weaknesses (CWE)
References
- https://jira.atlassian.com/browse/JRASERVER-72025Issue TrackingPatchVendor Advisory
- https://jira.atlassian.com/browse/JRASERVER-72025Issue TrackingPatchVendor Advisory
FAQ
What is CVE-2020-36232?
CVE-2020-36232 is a vulnerability with a CVSS score of 5.0 (MEDIUM). The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from version 4.3.2.0 before 4.3.2.4, from version 4.4.0 before 4.4.12, and from version 5...
How severe is CVE-2020-36232?
CVE-2020-36232 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-36232?
Check the references section above for vendor advisories and patch information. Affected products include: Atlassian Atlassian-Gadgets, Atlassian Data Center, Atlassian Jira Data Center, Atlassian Jira Server.