nuclei-templates/vulnerabilities/jira/jira-unauthenticated-user-p...

id: jira-unauthenticated-user-picker

info:
  name: Jira Unauthenticated User Picker
  author: TechbrunchFR
  severity: info
  metadata:
    shodan-query: http.component:"Atlassian Jira"
  tags: atlassian,jira

requests:
  - method: GET
    path:
      - "{{BaseURL}}/secure/popups/UserPickerBrowser.jspa"
    matchers:
      - type: word
        words:
          - 'user-picker'
Create jira-unauthenticated-user-picker.yaml Through the user picker functionality within Jira your user base information could be available to anonymous users. The Browse User Global Permission allows a user to view a list of all Jira user names and group names, share issues, and @mention people on issues. This is used for selecting users/groups in popup screens and also enables auto-completion of usernames in most 'User Picker' menus and popups. If you grant this permission to the Anyone group, you will be allowing anonymous users access to the endpoints that provide a list of users. Remediation: Ensure that this permission is restricted to specific groups that require it. You can restrict it in Administration > System > Global Permissions. 2020-07-06 10:23:09 +00:00			`id: jira-unauthenticated-user-picker`

			`info:`
			`name: Jira Unauthenticated User Picker`
			`author: TechbrunchFR`
misc changes 2021-02-10 16:37:17 +00:00			`severity: info`
Update jira-unauthenticated-user-picker.yaml 2022-07-04 13:18:18 +00:00			`metadata:`
			`shodan-query: http.component:"Atlassian Jira"`
misc changes 2021-02-10 16:37:17 +00:00			`tags: atlassian,jira`
Update jira-unauthenticated-user-picker.yaml Fix spaces 2020-07-06 10:28:08 +00:00
			`requests:`
Create jira-unauthenticated-user-picker.yaml Through the user picker functionality within Jira your user base information could be available to anonymous users. The Browse User Global Permission allows a user to view a list of all Jira user names and group names, share issues, and @mention people on issues. This is used for selecting users/groups in popup screens and also enables auto-completion of usernames in most 'User Picker' menus and popups. If you grant this permission to the Anyone group, you will be allowing anonymous users access to the endpoints that provide a list of users. Remediation: Ensure that this permission is restricted to specific groups that require it. You can restrict it in Administration > System > Global Permissions. 2020-07-06 10:23:09 +00:00			`- method: GET`
			`path:`
			`- "{{BaseURL}}/secure/popups/UserPickerBrowser.jspa"`
			`matchers:`
			`- type: word`
			`words:`
severity updates 2020-09-05 07:38:40 +00:00			`- 'user-picker'`