Description

The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.

Remediation

References

CVE-2019-3403

Related Vulnerabilities

Apache Tomcat Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2007-0450)

Magento Improper Input Validation Vulnerability (CVE-2019-7885)

Oracle Application Server CVE-2006-3712 Vulnerability (CVE-2006-3712)

Vanilla Forums Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-9685)

GlassFish Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-3250)

Severity

Medium

Classification

CVE-2019-3403 CWE-863

Tags

Missing Update Known Vulnerabilities