Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint.

This vulnerability was discovered by Mikhail Klyuchnikov of Positive Technologies.

The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.

Affected versions:

• version < 8.5.15
• 8.6.0 ≤ version < 8.13.7
• 8.14.0 ≤ version < 8.17.0

Fixed versions:

• 8.5.15
• 8.13.7
• 8.17.0

Note: this issue may also affect patched Jira instances if anonymous user access is enabled. For more information, refer to Atlassian's documentation on controlling anonymous user access.