CVE-2019-16909

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-11-01 · updated 2026-06-17
Weakness: CWE-862

Description

An issue was discovered in the Infosysta "In-App & Desktop Notifications" app before 1.6.14_J8 for Jira. It is possible to obtain a list of all Jira projects (with authentication as a Jira user, but without authorization for specific projects) via the plugins/servlet/nfj/NotificationSettings URI.

Affected products

Infosysta In-App & Desktop Notifications: before 1.6.14_j8 — fixed in 1.6.14_j8

How to fix

Upgrade to a fixed version: Infosysta In-App & Desktop Notifications 1.6.14_j8. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/154992/Infosysta-Jira-1.6.13_J8-Project-List-Authentication-Bypass.html
https://marketplace.atlassian.com/apps/1217434/in-app-desktop-notifications-for-jira
http://packetstormsecurity.com/files/154992/Infosysta-Jira-1.6.13_J8-Project-List-Authentication-Bypass.html
https://marketplace.atlassian.com/apps/1217434/in-app-desktop-notifications-for-jira

Get alerted when CVE-2019-16909 or the next vulnerability affects your stack