daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/http/vulnerabilities/jira/jira-unauthenticated-user-p...

23 lines
589 B
YAML
Raw Permalink Normal View History

Create jira-unauthenticated-user-picker.yaml Through the user picker functionality within Jira your user base information could be available to anonymous users. The Browse User Global Permission allows a user to view a list of all Jira user names and group names, share issues, and @mention people on issues. This is used for selecting users/groups in popup screens and also enables auto-completion of usernames in most 'User Picker' menus and popups. If you grant this permission to the Anyone group, you will be allowing anonymous users access to the endpoints that provide a list of users. Remediation: Ensure that this permission is restricted to specific groups that require it. You can restrict it in Administration > System > Global Permissions.
2020-07-06 10:23:09 +00:00
id: jira-unauthenticated-user-picker
info:
name: Jira Unauthenticated User Picker
author: TechbrunchFR
misc changes
2021-02-10 16:37:17 +00:00
severity: info
Update jira-unauthenticated-user-picker.yaml
2022-07-04 13:18:18 +00:00
metadata:
Added max request counter of each template
2023-04-28 08:11:21 +00:00
max-request: 1
Update jira-unauthenticated-user-picker.yaml
2022-07-04 13:18:18 +00:00
shodan-query: http.component:"Atlassian Jira"
misc changes
2021-02-10 16:37:17 +00:00
tags: atlassian,jira
Update jira-unauthenticated-user-picker.yaml Fix spaces
2020-07-06 10:28:08 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
2023-04-27 04:28:59 +00:00
http:
Create jira-unauthenticated-user-picker.yaml Through the user picker functionality within Jira your user base information could be available to anonymous users. The Browse User Global Permission allows a user to view a list of all Jira user names and group names, share issues, and @mention people on issues. This is used for selecting users/groups in popup screens and also enables auto-completion of usernames in most 'User Picker' menus and popups. If you grant this permission to the Anyone group, you will be allowing anonymous users access to the endpoints that provide a list of users. Remediation: Ensure that this permission is restricted to specific groups that require it. You can restrict it in Administration > System > Global Permissions.
2020-07-06 10:23:09 +00:00
- method: GET
path:
- "{{BaseURL}}/secure/popups/UserPickerBrowser.jspa"
templateman update
2023-10-14 11:27:55 +00:00
Create jira-unauthenticated-user-picker.yaml Through the user picker functionality within Jira your user base information could be available to anonymous users. The Browse User Global Permission allows a user to view a list of all Jira user names and group names, share issues, and @mention people on issues. This is used for selecting users/groups in popup screens and also enables auto-completion of usernames in most 'User Picker' menus and popups. If you grant this permission to the Anyone group, you will be allowing anonymous users access to the endpoints that provide a list of users. Remediation: Ensure that this permission is restricted to specific groups that require it. You can restrict it in Administration > System > Global Permissions.
2020-07-06 10:23:09 +00:00
matchers:
- type: word
words:
templateman update
2023-10-14 11:27:55 +00:00
- 'user-picker'
TemplateMan Update [Fri Oct 20 11:41:12 UTC 2023] :robot:
2023-10-20 11:41:13 +00:00
# digest: 490a0046304402200087bccdda4eb25b5110e1333de30442f5744e55aa8f2b5db3cf5d01c54e3837022068d85868176036eb3b1420b5aa186064b791ca1486a60f7e1c8fed872ad1f402:922c64590222798bb761d5b6d8e72950