Vulnerability Description
The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.1 allows remote attackers to inject arbitrary HTML or JavaScript via a DOM Cross-Site Scripting (XSS) vulnerability caused by parameter pollution.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Data Center | < 8.5.12 |
| Atlassian | Jira | < 8.5.12 |
| Atlassian | Jira Data Center | >= 8.6.0, < 8.13.4 |
| Atlassian | Jira Server | >= 8.6.0, < 8.13.4 |
Related Weaknesses (CWE)
References
- https://jira.atlassian.com/browse/JRASERVER-72115Third Party Advisory
- https://jira.atlassian.com/browse/JRASERVER-72115Third Party Advisory
FAQ
What is CVE-2020-36288?
CVE-2020-36288 is a vulnerability with a CVSS score of 6.1 (MEDIUM). The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.1 allows remote attacke...
How severe is CVE-2020-36288?
CVE-2020-36288 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-36288?
Check the references section above for vendor advisories and patch information. Affected products include: Atlassian Data Center, Atlassian Jira, Atlassian Jira Data Center, Atlassian Jira Server.