Data Center
CVE-2021-39118
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full names of users via an enumeration vulnerability in the /rest/api/1.0/render endpoint. The affected versions are before version 8.19.0.
AnalysisAI
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full names of users via an enumeration vulnerability in the /rest/api/1.0/render. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full names of users via an enumeration vulnerability in the /rest/api/1.0/render endpoint. The affected versions are before version 8.19.0. Affected products include: Atlassian Data Center, Atlassian Jira. Version information: version 8.19.0..
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Data Center
View allThe number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before
Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Infor
Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to impact the applicat
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached c
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protectio
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or
The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from ve
The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 be
Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6
The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, an
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to discover the usernames of
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today