Medium severity6.1NVD Advisory· Published Feb 15, 2021· Updated Jun 17, 2026
CVE-2020-36236
CVE-2020-36236
Description
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the ViewWorkflowSchemes.jspa and ListWorkflows.jspa endpoints. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
8- Range: <8.5.11, 8.6.0 to <8.13.3, 8.14.0 to <8.15.0
unspecified+ 1 more
- (no CPE)range: unspecified
- cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*range: >=8.6.0,<8.13.3
- Range: unspecified
- cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*Range: >=8.6.0,<8.13.3
- cpe:2.3:a:atlassian:jira_software_data_center:*:*:*:*:*:*:*:*Range: <8.5.11
Patches
Vulnerability mechanics
References
1- jira.atlassian.com/browse/JRASERVER-72015nvdIssue TrackingVendor Advisory
News mentions
0No linked articles in our index yet.