LiveActive security incident?Get immediate response
CVE Record

CVE-2020-36287: The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data...

The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to obtain gadget related settings via a missing permissions check.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Jira Server and Data Center issue let anonymous remote users read dashboard gadget preference settings because a permission check was missing. The sources do not describe data sensitivity, CVSS scoring, or active exploitation. Business urgency depends on whether affected Jira instances are externally reachable and whether gadget settings expose operational information.

Executive priority

Handle as a targeted information-disclosure risk, not a confirmed breach. Prioritize patching if Jira is internet-facing or allows anonymous access. The absence of CVSS and exploitation evidence lowers certainty, but anonymous access to internal settings can still support reconnaissance.

Technical view

CVE-2020-36287 is a CWE-863 incorrect authorization flaw in the Atlassian gadgets plugin dashboard gadgets preference resource. Jira Server/Data Center versions before 8.13.5, and 8.14.0 before 8.15.1, allowed unauthenticated remote access to gadget-related settings due to a missing permission check.

Likely exposure

Exposure is most likely on Jira Server or Jira Data Center deployments running affected versions, especially instances reachable by anonymous or internet users. The provided sources do not identify cloud exposure, vulnerable endpoints, or required configuration details beyond the affected version ranges.

Exploitation context

The bundle states remote anonymous attackers could obtain gadget-related settings. CISA KEV is false, and the provided sources do not claim active exploitation, public exploit availability, or observed attacks. Treat exploitation status as unconfirmed from this evidence.

Researcher notes

Available evidence is narrow: affected version ranges, CWE-863 classification, and anonymous remote information exposure. The sources do not define exact endpoint behavior, returned fields, exploit prevalence, or patch mechanics. Validation should avoid intrusive probing and focus on version, exposure, and vendor advisory confirmation.

Mitigation direction

  • Upgrade affected Jira Server/Data Center to 8.13.5, 8.15.1, or later supported versions.
  • Review Atlassian JRASERVER-72258 for vendor-specific remediation guidance.
  • Prioritize externally reachable Jira instances before internal-only deployments.
  • Check whether anonymous access is enabled while upgrade planning is underway.

Validation and detection

  • Inventory Jira Server and Data Center versions across all environments.
  • Confirm no deployment is below 8.13.5 or in 8.14.0 before 8.15.1.
  • Identify Jira instances reachable from the internet or untrusted networks.
  • Review access logs for anonymous requests to dashboard gadget preference resources.
  • Document compensating controls if immediate upgrade is delayed.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-863: Authorization and privilege behavior lookup

Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-36287 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
AtlassianJira Serverunspecified, 8.14.0, unspecifiedListed
AtlassianJira Data Centerunspecified, 8.14.0, unspecifiedListed
Weakness

CWE details

CWE-863

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.