CVE-2019-3403

EPSS 82.8%
Veröffentlicht 22.05.2019 18:29:00
Zuletzt bearbeitet 21.11.2024 04:42:02
Quelle security@atlassian.com
CVE-Watchlists
Login
Unerledigt
Login

The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Atlassian ≫ Jira Version < 7.13.3

Atlassian ≫ Jira Server Version >= 8.0.0 < 8.0.4

Atlassian ≫ Jira Server Version >= 8.1.0 < 8.1.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	82.8%	0.992

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://jira.atlassian.com/browse/JRASERVER-69242

Vendor Advisory

Issue Tracking

https://nvd.nist.gov/vuln/detail/CVE-2019-3403

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-3403

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-3403

EUVD