What’s Vulnerable › Vulnerabilities
CVE-2019-14997
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-09-11 · updated 2026-06-17
- Weakness: CWE-524
Description
The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers to learn details about other users, including their username, via an information expose through caching vulnerability when Jira is configured with a reverse Proxy and or a load balancer with caching or a CDN.
Affected products
- Atlassian Jira: from 7.13.0 before 8.4.0 — fixed in 8.4.0
How to fix
Upgrade to a fixed version: Atlassian Jira 8.4.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2019-14997 or the next vulnerability affects your stack