CVE-2019-3403

🗓️ 22 May 2019 17:35:03Reported by atlassianType

cve🔗 web.nvd.nist.gov👁 161 Views🌐 WEB

Jira /rest/api/2/user/picker resource allows username enumeration

Reporter	Title	Published	Views	Family All 18
GithubExploit	Exploit for Incorrect Authorization in Atlassian Jira	18 Mar 202122:36	–	githubexploit
Atlassian	Information disclosure in the /rest/api/2/user/picker rest resource - CVE-2019-3403	29 Apr 201903:57	–	atlassian
Atlassian	Information disclosure in the /rest/api/2/user/picker rest resource - CVE-2019-3403	29 Apr 201903:57	–	atlassian
Circl	CVE-2019-3403	22 May 201918:48	–	circl
CNVD	Atlassian Jira Username Enumeration Vulnerability	23 May 201900:00	–	cnvd
Cvelist	CVE-2019-3403	22 May 201917:35	–	cvelist
Hacker One	U.S. Dept Of Defense: CVE-2019-3403 on https://████/rest/api/2/user/picker?query=	3 Apr 202118:52	–	hackerone
Hacker One	OneWeb: Vulnerable Jira Instance	27 Sep 202114:44	–	hackerone
Hacker One	Starbucks: Information disclosure on sim.starbucks.com	30 Jun 201912:11	–	hackerone
Hacker One	Mail.ru: Path traversal lead to LFR via [CVE-2019-3394]	12 Sep 202021:50	–	hackerone

NVD

Node

atlassian jiraRange<7.13.3

atlassian jira_serverRange8.0.0–8.0.4

atlassian jira_serverRange8.1.0–8.1.1

[
  {
    "product": "Jira",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "7.13.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.0.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.0.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.1.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.1.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
jira	www.jira.atlassian.com/browse/JRASERVER-69242

Parameter	Position	Path	Description	CWE
query	query param	rest/api/2/user/picker	Remote enumeration of Jira usernames via incorrect authorization on the /rest/api/2/user/picker endpoint (CVE-2019-3403).	CWE-863

21 Nov 2024 04:42Current

5.4Medium risk

Vulners AI Score5.4

CVSS 25

CVSS 3.15.3

EPSS0.828

CWE-863