CVE-2019-3403

medium · 5.3

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.

5.3

CVSS

52.6%

EPSS (exploit prob.)

99th

EPSS percentile

2019-05-22

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-863

Affected products

Vendor	Product	Affected versions
atlassian	jira	< 7.13.3
atlassian	jira_server	>= 8.0.0, < 8.0.4
atlassian	jira_server	>= 8.1.0, < 8.1.1

Check a specific version with /api/v1/cve/match.

References

https://jira.atlassian.com/browse/JRASERVER-69242
https://jira.atlassian.com/browse/JRASERVER-69242

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2019-3403