CVE-2019-8449

CVE-2019-8449: vulnerability in Atlassian Jira

Published · Updated

Follow this CVE+ Monitor Jira

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

62Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 86%
from disclosure to weapon144 days
Published on NVDSep 11
1st PoC+144d
The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability.
Affected products
Atlassian · Jira
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Atlassian Jira

In the same product, most dangerous first.

CVE-2019-8451—CVE-2019-8451EPSS 94.5%CVE-2019-8442—CVE-2019-8442EPSS 59.8%CVE-2019-3403—CVE-2019-3403EPSS 53.6%CVE-2018-20824—CVE-2018-20824EPSS 38.0%CVE-2018-5230—CVE-2018-5230EPSS 37.0%CVE-2019-8446—CVE-2019-8446EPSS 17.5%