Security readout for executives and security teams
Plain-English summary
This flaw can expose page content meant for one Sitecore JSS React Sample Application user to another user. The business risk is confidentiality loss, especially if the sample application handles personalized, customer, or internal content. The sources rate it high severity with CVSS 8.7.
Executive priority
Treat this as a high-priority confidentiality issue if the affected sample application is deployed with real or personalized content. Prioritize inventory first, then vendor remediation. Urgency is lower for organizations that never deployed the sample application or only used it in isolated nonproduction environments.
Technical view
CVE-2020-36850 is a CWE-200 information disclosure issue in Sitecore JSS React Sample Application versions described as 11.0.0 through 14.0.1. The stated impact is cross-user page content disclosure. The provided CVSS v4.0 vector indicates network exposure, low complexity, no privileges, no user interaction, and high vulnerable-system confidentiality impact.
Likely exposure
Exposure is limited to environments running the Sitecore JSS React Sample Application in the affected version range. Public-facing or authenticated deployments serving user-specific content have higher concern. Evidence does not identify other Sitecore products as affected.
Exploitation context
The bundle does not cite active exploitation, and KEV is false. The vulnerability is remotely reachable by CVSS, but the provided sources do not include exploit status, exploitation examples, or proof-of-concept details.
Researcher notes
Key missing detail is the exact fixed version or configuration change; the bundle only labels Sitecore advisories as patch references. Avoid broad Sitecore assumptions. Focus validation on affected JSS React Sample Application versions and the observed impact: unintended cross-user page content disclosure.
Mitigation direction
- Review Sitecore KB0750906 and KB1001612 for vendor-approved remediation.
- Apply Sitecore’s documented patch or upgrade guidance for affected deployments.
- Inventory whether the JSS React Sample Application is deployed in production.
- Remove or disable nonessential sample application deployments where practical.
- Limit exposure of affected deployments until vendor remediation is complete.
Validation and detection
- Identify all Sitecore JSS React Sample Application versions in use.
- Confirm whether any deployments fall within 11.0.0 through 14.0.1.
- Verify remediation status against Sitecore KB0750906 and KB1001612.
- Review incident reports for users seeing another user’s page content.
- After remediation, validate user-specific content isolation in controlled testing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-36850 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0750906CVE reference · vendor-advisory, patch
- https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1001612CVE reference · vendor-advisory, patch
- https://www.vulncheck.com/advisories/sitecore-jss-react-sample-application-info-discCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.