[JRASERVER-69244] Information disclosure in the ManageFilters.jspa resource - CVE-2019-3401 - Create and track feature requests for Atlassian products.

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Medium
Resolution: Fixed
Affects Version/s: 7.6.0, 7.12.3
Fix Version/s: 7.6.13, 7.13.3, 8.2.0, 8.1.1
Component/s: Filters & Dashboards - Permissions
Labels:

Introduced in Version:
7.06
Symptom Severity:
Severity 3 - Minor
Bug Fix Policy:
View Atlassian Server bug fix policy
Fixed in Enterprise Release/s:

Download 7.13, 7.6

Description

The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.

Attachments

Issue Links

mentioned in: Page Loading...

Activity

People

Assignee:: Daniel Rauf

Reporter:: Security Metrics Bot

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 29/Apr/2019 4:02 AM

Updated:: 22/May/2020 8:24 AM

Resolved:: 29/Apr/2019 4:02 AM