CVE-2020-36287: 
JIRA vulnerability analysis and mitigation

The vulnerability (CVE-2020-36287) affects the dashboard gadgets preference resource of the Atlassian gadgets plugin in Jira Server and Jira Data Center. The issue exists in versions before 8.13.5 and versions 8.14.0 to 8.15.1 (excluding 8.15.1). This security flaw was discovered and publicly disclosed in March 2021, allowing remote anonymous attackers to access gadget-related settings due to missing permission checks (Vendor Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium severity) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The issue is classified under CWE-862 (Missing Authorization) and stems from incorrect authorization controls in the dashboard gadgets preference resource (NVD).

When exploited, this vulnerability allows unauthorized users to obtain gadget-related settings from the affected Jira instances. The impact is primarily focused on information disclosure, with no direct impact on system integrity or availability (Vendor Advisory).

The vulnerability can be exploited by remote attackers without requiring authentication or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (NVD).

Atlassian has released fixed versions to address this vulnerability. Users should upgrade to either version 8.13.5 (if running on the 8.13.x branch) or version 8.15.1 (if running on 8.14.x or later). These patches implement proper authorization checks for the affected functionality (Vendor Advisory).