Description

REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to enumerate usernames via a Sensitive Data Exposure vulnerability in the `/rest/api/latest/user/avatar/temporary` endpoint.

Remediation

References

CVE-2021-26081

Related Vulnerabilities

Python Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-1015)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-17868)

Oracle JRE CVE-2019-2983 Vulnerability (CVE-2019-2983)

Undertow Uncontrolled Resource Consumption Vulnerability (CVE-2022-2053)

WordPress Plugin Quiz and Survey Master (QSM)-Easy Quiz and Survey Maker Cross-Site Scripting (7.3.1)

Severity

Medium

Classification

CVE-2021-26081

Tags

Missing Update Known Vulnerabilities