CVE-2019-3401

MEDIUM NUCLEI

Jira < 7.13.3 and 8.0.0-8.1.1 - Unauthenticated Username Enumeration via ManageFilters.jspa

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2019-3401 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.

Nuclei Templates (1)

Atlassian Jira <7.13.3/8.0.0-8.1.1 - Incorrect Authorization
MEDIUMby TechbrunchFR,milo2012
Shodan: http.component:"Atlassian Jira" || http.component:"atlassian jira" || http.component:"atlassian confluence" || cpe:"cpe:2.3:a:atlassian:jira"

References (1)

Core 1
Core References
Issue Tracking, Vendor Advisory x_refsource_misc
https://jira.atlassian.com/browse/JRASERVER-69244

Scores

CVSS v3 5.3
EPSS 0.1272
EPSS Percentile 95.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-863
Status published
Products (2)
atlassian/jira < 7.13.3
atlassian/jira_server 8.0.0 - 8.1.1
Published May 22, 2019
Tracked Since Feb 18, 2026