Description

REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to enumerate usernames via a Sensitive Data Exposure vulnerability in the `/rest/api/latest/user/avatar/temporary` endpoint.

Remediation

References

CVE-2021-26081

Related Vulnerabilities

EspoCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-14549)

MySQL CVE-2018-3276 Vulnerability (CVE-2018-3276)

Oracle Database Server CVE-2021-2332 Vulnerability (CVE-2021-2332)

WordPress Plugin Image Export Arbitrary File Download (1.1.0)

GlassFish Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2017-1000028)

Severity

Medium

Classification

CVE-2021-26081

Tags

Missing Update Known Vulnerabilities