Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclosure vulnerability in the /rest/api/2/search endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.

According to its self-reported version number, the Atlassian Jira application running on the remote host is prior to 8.5.13, 8.6.0 prior to 8.13.15 or 8.14.0 prior to 8.15.1. It is, therefore, affected by a vulnerability which may permit anonymous remote attackers to view users' emails via an Information Disclosure vulnerability in the /rest/api/2/search endpoint.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
113685	Atlassian Jira 8.14.0 < 8.15.1 User Enumeration Via Render Endpoint	Web App Scanning	Component Vulnerability	medium
113684	Atlassian Jira 8.6.0 < 8.13.15 User Enumeration Via Render Endpoint	Web App Scanning	Component Vulnerability	medium
113683	Atlassian Jira < 8.5.13 User Enumeration Via Render Endpoint	Web App Scanning	Component Vulnerability	medium

Detections

Analytics

CVE-2021-39122

medium

Tenable Plugins

medium

medium

medium