CVE-2020-36286: The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymo...

Summary

The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a group exists & members of groups if they are assigned to publicly visibl...

What to do

Update atlassian data_center to version 8.5.13 or later.
Update atlassian jira to version 8.5.13 or later.

Affected software

Vendor	Product	Affected versions
atlassian	data_center	< 8.5.13 `cpe:2.3:a:atlassian:data_center::::::::`
atlassian	jira	< 8.5.13 `cpe:2.3:a:atlassian:jira::::::::`
atlassian	jira_data_center	>= 8.6.0, < 8.13.5 >= 8.14.0, < 8.15.1 `cpe:2.3:a:atlassian:jira_data_center::::::::`
atlassian	jira_server	>= 8.6.0, < 8.13.5 >= 8.14.0, < 8.15.1 `cpe:2.3:a:atlassian:jira_server::::::::`

Original advisory text

The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymo...

The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a group exists & members of groups if they are assigned to publicly visible issue field.

References

https://jira.atlassian.com/browse/JRASERVER-72272 Vendor Advisory