CVE-2020-36237: 
JIRA vulnerability analysis and mitigation

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Information Disclosure vulnerability in the /rest/api/2/customFieldOption/ endpoint. The vulnerability affects versions before 8.15.0 and was assigned CVE-2020-36237. The issue was discovered and reported in February 2021 (Jira Issue).

The vulnerability exists in the REST API endpoint /rest/api/2/customFieldOption/ which improperly exposes custom field options to unauthenticated users. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) and CVSS v2.0 base score of 5.0 MEDIUM (Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N) (NVD).

This information disclosure vulnerability allows unauthenticated remote attackers to view custom field options in Jira instances. The vulnerability has a high impact on confidentiality but no impact on integrity or availability of the system (NVD).

The vulnerability can be exploited by unauthenticated remote attackers by accessing the affected REST API endpoint. No special conditions or user interaction is required for exploitation (NVD).

The vulnerability was fixed in Jira version 8.15.0. Organizations running affected versions should upgrade to version 8.15.0 or later to address this security issue (Jira Issue).