CVE-2021-39125

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to discover the usernames of users via an enumeration vulnerability in the password reset page. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Sep 14, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-391266.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forge CVE-2021-391275.3Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a Broken CVE-2021-391287.2Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administr CVE-2021-391317.5ced detects character encoding using Google’s compact_enc_det library. In ced v0.1.0, passing data types other than `Buffer` causes the Node CVE-2021-391328.8Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3,CVE-2021-391336.8Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3,CVE-2021-391347.8`@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line in CVE-2021-391357.8`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line inte CVE-2021-391365.4baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site s CVE-2021-391377.5go-ethereum is the official Go implementation of the Ethereum protocol. In affected versions a consensus-vulnerability in go-ethereum (Geth)CVE-2021-391386.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Developers can use the REST API to s CVE-2021-391398.8XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker