Description
REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to enumerate usernames via a Sensitive Data Exposure vulnerability in the `/rest/api/latest/user/avatar/temporary` endpoint.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected products
- Atlassian / Jira Data Centerunspecified – 8.16.1
- Atlassian / Jira Data Centerunspecified – 8.5.14
- Atlassian / Jira Data Center8.6.0 – unspecified
- Atlassian / Jira Data Centerunspecified – 8.13.6
- Atlassian / Jira Data Center8.14.0 – unspecified
- Atlassian / Jira Serverunspecified – 8.5.14
- Atlassian / Jira Server8.6.0 – unspecified
- Atlassian / Jira Serverunspecified – 8.13.6
- Atlassian / Jira Server8.14.0 – unspecified
- Atlassian / Jira Serverunspecified – 8.16.1