CVE-2019-8449

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 84.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-09-11 · updated 2026-06-17
Weakness: CWE-306

Description

The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability.

Affected products

Atlassian Jira: before 8.4.0 — fixed in 8.4.0

How to fix

Upgrade to a fixed version: Atlassian Jira 8.4.0. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/156172/Jira-8.3.4-Information-Disclosure.html
https://jira.atlassian.com/browse/JRASERVER-69796
http://packetstormsecurity.com/files/156172/Jira-8.3.4-Information-Disclosure.html
https://jira.atlassian.com/browse/JRASERVER-69796

Get alerted when CVE-2019-8449 or the next vulnerability affects your stack