CVE-2021-26081

REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to enumerate usernames via a Sensitive Data Exposure vulnerability in the /rest/api/latest/user/avatar/temporary endpoint.

Published: Jul 20, 2021
Updated: Apr 14, 2023
CVE: CVE-2021-26081
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.3
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:P/I:N/A:N

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
atlassian / data_center	-	8.5.14
atlassian / jira	-	8.5.14
atlassian / jira_server	8.6.0	8.13.6
atlassian / jira_server	8.14.0	8.16.1
atlassian / jira_data_center	8.6.0	8.13.6
atlassian / jira_data_center	8.14.0	8.16.1

https://jira.atlassian.com/browse/JRASERVER-72499

Vulnerability Database

289,697

CVE-2021-26081