CVE-2020-14181

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 99.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-09-17 · updated 2026-06-17
Weakness: CWE-200

Description

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.

Affected products

Atlassian Data Center: before 7.13.6; from 8.0.0 before 8.5.7; from 8.6.0 before 8.12.0 — fixed in 7.13.6, 8.12.0, 8.5.7
Atlassian Jira: before 7.13.6 — fixed in 7.13.6
Atlassian Jira: from 8.0.0 before 8.5.7; from 8.6.0 before 8.12.0 — fixed in 8.12.0, 8.5.7

How to fix

Upgrade to a fixed version: Atlassian Data Center 7.13.6, 8.12.0, 8.5.7; Atlassian Jira 7.13.6; Atlassian Jira 8.12.0, 8.5.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-14181 or the next vulnerability affects your stack