CVE-2019-8448

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attackers to enumerate usernames via an information disclosure vulnerability.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
Atlassian	Jira	>= unspecified, < 7.13.4; >= 8.0.0, < unspecified; >= unspecified, < 8.2.2

References

https://jira.atlassian.com/browse/JRASERVER-69797Vendor Advisory
https://jira.atlassian.com/browse/JRASERVER-69797Vendor Advisory

Timeline

Published: Aug 13, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-84495.3The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information CVE-2019-84504.8Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attacke CVE-2019-84516.5The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal net CVE-2019-84527.8A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before CVE-2019-84535.5Some of the DLLs loaded by Check Point ZoneAlarm up to 15.4.062 are taken from directories where all users have write permissions. This can CVE-2019-84547.0A local attacker can create a hard-link between a file to which the Check Point Endpoint Security client for Windows before E80.96 writes an CVE-2019-84557.1A hard-link created from the log file of Check Point ZoneAlarm up to 15.4.062 to any file on the system will get its permission changed so t CVE-2019-84565.9Check Point IKEv2 IPsec VPN up to R80.30, in some less common conditions, may allow an attacker with knowledge of the internal configuration CVE-2019-84579.8SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree t CVE-2019-84584.4Check Point Endpoint Security Client for Windows, with Anti-Malware blade installed, before version E81.00, tries to load a non-existent DLL CVE-2019-84599.8Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the pa CVE-2019-84607.5OpenBSD kernel version <= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcp_sack_option() fo