CVE-2019-8446

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Atlassian	Jira	>= unspecified, < 8.3.2

References

https://jira.atlassian.com/browse/JRASERVER-69777Vendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0839Exploit, Third Party Advisory
https://jira.atlassian.com/browse/JRASERVER-69777Vendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0839Exploit, Third Party Advisory

Timeline

Published: Aug 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-84474.3The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site r CVE-2019-84485.3The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attackers to enumerate usern CVE-2019-84495.3The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information CVE-2019-84504.8Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attacke CVE-2019-84516.5The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal net CVE-2019-84527.8A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before CVE-2019-84535.5Some of the DLLs loaded by Check Point ZoneAlarm up to 15.4.062 are taken from directories where all users have write permissions. This can CVE-2019-84547.0A local attacker can create a hard-link between a file to which the Check Point Endpoint Security client for Windows before E80.96 writes an CVE-2019-84557.1A hard-link created from the log file of Check Point ZoneAlarm up to 15.4.062 to any file on the system will get its permission changed so t CVE-2019-84565.9Check Point IKEv2 IPsec VPN up to R80.30, in some less common conditions, may allow an attacker with knowledge of the internal configuration CVE-2019-84579.8SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree t CVE-2019-84584.4Check Point Endpoint Security Client for Windows, with Anti-Malware blade installed, before version E81.00, tries to load a non-existent DLL