CVE-2019-16907 - An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira

Back Back to CVE browser

MEDIUM

An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira

Published Oct 31, 2019

5.3

MEDIUM

CVSS 3.1

EPSS 1.57%

Description

An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira. It is possible to obtain a list of all valid Jira usernames without authentication/authorization via the plugins/servlet/nfj/UserFilter?searchQuery=@ URI.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-306

Missing Authentication

CWE-862

Missing Authorization

References (2)

http://packetstormsecurity.com/files/154993/Infosysta-Jira-1.6.13_J8-User-Name-Disclosure.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://seclists.org/bugtraq/2019/Nov/0
mailing-listx_refsource_BUGTRAQMailing ListThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/154993/Infosysta-Jira-1.6.13_J8-User-Name-Disclosure.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://seclists.org/bugtraq/2019/Nov/0		mailing-listx_refsource_BUGTRAQMailing ListThird Party Advisory