H3-2022-0081
Atlassian Jira Unauthenticated User Enumeration via the User Picker Browser
| Category | SECURITY_MISCONFIGURATION |
| Base Score | 5.0 |
Description
The User Picker Browser component in Jira enables a Jira user to view and select other Jira users. As a result of an access control misconfiguration, anyone with network access to Jira can abuse this component to enumerate all users in Jira. User data includes the users' full names, usernames, and e-mail addresses.
Impact
An unauthenticated attacker can query the Jira instance and compile a list of known usernames and e-mail addresses. These usernames can be used to conduct credential attacks such as password spray and credential stuffing. E-mail addresses can be used in phishing attacks.