ID:5340 - Exploit for Information disclosure in Jira Software - CVE-2019-8449

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to an information expose in the "/rest/api/latest/groupuserpicker" resource. A remote attacker can enumerate usernames and gain unauthorized access to sensitive information on the system.

Remediation