CVE-2020-36238: 
JIRA vulnerability analysis and mitigation

The vulnerability (CVE-2020-36238) affects Jira Server and Data Center's /rest/api/1.0/render resource. The issue was discovered in multiple versions: before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1. The vulnerability was reported on January 27, 2021, and was fixed with the release of versions 8.5.13, 8.13.5, and 8.15.1 (Atlassian Jira).

The vulnerability is related to a missing permissions check in the /rest/api/1.0/render resource. The issue has been assigned a CVSS Score of 3.0, indicating Low severity. The vulnerability is classified under CWE-863, which relates to incorrect authorization (Atlassian Jira).

The vulnerability allows remote anonymous attackers to determine if a username is valid or not through the affected resource. This information disclosure could potentially be used as a stepping stone for further attacks by helping attackers identify valid user accounts in the system (Atlassian Jira).

The vulnerability can be exploited by remote anonymous attackers, requiring no authentication to perform the username enumeration attack. The attack vector is through the /rest/api/1.0/render resource in the affected Jira installations (Atlassian Jira).

Atlassian has released fixed versions to address this vulnerability. Users should upgrade to version 8.5.13 if running 8.5.x, version 8.13.5 if running 8.6.0-8.13.x, or version 8.15.1 if running 8.14.0-8.15.0 (Atlassian Jira).