• Type: Public Security Vulnerability
• Resolution: Fixed
• Priority: Low (View bug fix roadmap)
• Fix Version/s: 8.5.13, 8.13.5, 8.15.1, 8.16.0
• Affects Version/s: 8.8.1, 8.5.11, 8.5.12
• Component/s: None
• Labels:

  • CVE-2021-39122
  • advisory
  • advisory-released
  • dont-import
  • security

[JRASERVER-72293] Anonymous users are able to view user information through the /rest/api/2/search endpoint - CVE-2021-39122

Collapse comment: AB added a comment - 01/Sep/2021 11:45 PM, Edited by Security Metrics Bot - 01/Sep/2021 11:53 PM

AB added a comment - 01/Sep/2021 11:45 PM - edited

This is an independent assessment and you should evaluate its applicability to your own IT environment.

CVSS v3 score: 3.7 => Low severity

Exploitability Metrics

Attack Vector	Network
Attack Complexity	High
Privileges Required	None
User Interaction	None

Scope Metric

Scope	Unchanged

Impact Metrics

Confidentiality	Low
Integrity	None
Availability	None

https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/CR:L/MPR:L/MC:L

Expand comment: AB added a comment - 01/Sep/2021 11:45 PM, Edited by Security Metrics Bot - 01/Sep/2021 11:53 PM

AB added a comment - 01/Sep/2021 11:45 PM - edited This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 3.7 => Low severity Exploitability Metrics Attack Vector Network Attack Complexity High Privileges Required None User Interaction None Scope Metric Scope Unchanged Impact Metrics Confidentiality Low Integrity None Availability None https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/CR:L/MPR:L/MC:L