Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-3401 — Incorrect Authorization in Atlassian Jira

CWE-863 — Incorrect Authorization4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
66.0%
top 1.48%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Atlassian JiraAtlassian Jira Server
Timeline
PublishedMay 22
Latest updateMay 24

Description

The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5atlassian/jiraunspecified — 7.13.3+2
▶NVDatlassian/jira< 7.13.3
▶NVDatlassian/jira_server8.0.0 — 8.1.1

🔴Vulnerability Details

2
GHSA
GHSA-pmwf-r7hc-gwpq: The ManageFilters↗2022-05-24
▶
CVEList
CVE-2019-3401: The ManageFilters↗2019-05-22
▶

💥Exploits & PoCs

1
Nuclei
Atlassian Jira <7.13.3/8.0.0-8.1.1 - Incorrect Authorization
▶
CVE-2019-3401 — Incorrect Authorization in Atlassian | cvebase