CVE-2020-36288: 
JIRA vulnerability analysis and mitigation

The vulnerability CVE-2020-36288 affects Jira Server and Data Center's issue navigation and search view functionality. The vulnerability was discovered and reported by Peter af Geijerstam, with the CVE being created on March 31, 2021. It affects multiple versions of the software: versions before 8.5.12, versions 8.6.0 to 8.13.4, and versions 8.14.0 to 8.15.1 (Atlassian JIRA).

The vulnerability is classified as a DOM Cross-Site Scripting (XSS) vulnerability caused by parameter pollution, which allows remote attackers to inject arbitrary HTML or JavaScript. The vulnerability has received a CVSS v3.1 base score of 7.1 (High severity) with the following vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability requires user interaction for successful exploitation (NVD NIST).

When exploited, this vulnerability allows attackers to inject arbitrary HTML or JavaScript code into the affected Jira instances. The impact is primarily focused on compromising data confidentiality and integrity, as indicated by the CVSS metrics showing Low impact for both Confidentiality and Integrity, with no impact on Availability (NVD NIST).

The vulnerability requires network access (AV:N) with low attack complexity (AC:L). No privileges are required (PR:N), but user interaction (UI:R) is necessary for successful exploitation. As of the available information, there are no known public exploits specifically targeting this vulnerability (ManageEngine).

Atlassian has released fixed versions to address this vulnerability: version 8.5.12, 8.13.4, and 8.15.1. Organizations running affected versions should upgrade to the appropriate fixed version based on their current installation (Atlassian JIRA).