Loading...

XML

Word

Printable

Details

Type: Bug
Resolution: Fixed
Priority: Low
Fix Version/s: 7.13.3, 8.2.0, 8.1.1
Affects Version/s: 7.13.0
Component/s: User Management - Others
Labels:

Fixed in Long Term Support Release/s:

Download 7.13
Introduced in Version:
7.13
Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

Description

The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.

Attachments

Issue Links

causes

JRASERVER-69787 Cannot select reporter when creating an issue while not signed in.

Closed

mentioned in: Page Loading...; Page Loading...

Activity

People

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Votes:: 0 Vote for this issue

Watchers:: 9 Start watching this issue

Dates

Created:: 29/Apr/2019 3:57 AM

Updated:: 17/Oct/2021 8:24 PM

Resolved:: 29/Apr/2019 3:57 AM