CVE-2020-14181
60Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 100%
from disclosure to weapon0 days
Published on NVDSep 17
1st PoCSep 15
metasploitAug 16
exploitation probability
100%top 1% of all CVEs
observed exploitation
nono source reports it
5 public exploit(s)
Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.
Affected products
Atlassian · Jira Serverpublic PoCs found — 5
exploitdbwww.exploit-db.com/exploits/49633unverifiedgithubgithub.com/Rival420/CVE-2020-14181★ 8githubgithub.com/bk-rao/CVE-2020-14181★ 2githubgithub.com/und3sc0n0c1d0/UserEnumJira★ 1cve_referencepacketstormsecurity.com/files/161730/Atlassian-JIRA-8.11.1-User-Enumeration.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.