CVE-2019-3403 : Security Advisory and Response

In May 2019, a vulnerability was discovered in Atlassian's Jira software that could allow remote attackers to gather a list of usernames by exploiting a specific rest resource.

Understanding CVE-2019-3403

What is CVE-2019-3403?

The vulnerability exists in versions of Jira prior to 7.13.3, versions 8.0.0 to 8.0.4, and versions 8.1.0 to 8.1.1, specifically in the /rest/api/2/user/picker rest resource.

The Impact of CVE-2019-3403

This vulnerability could be exploited by remote attackers to bypass authorization checks and collect usernames, potentially leading to unauthorized access and information disclosure.

Technical Details of CVE-2019-3403

Vulnerability Description

The /rest/api/2/user/picker rest resource in affected versions of Jira allows remote attackers to enumerate usernames due to an incorrect authorization check.

Affected Systems and Versions

Jira versions prior to 7.13.3
Jira versions 8.0.0 to 8.0.4
Jira versions 8.1.0 to 8.1.1

Exploitation Mechanism

Remote attackers can exploit this vulnerability to gather a list of usernames by bypassing the authorization check in the /rest/api/2/user/picker rest resource.

Mitigation and Prevention

Immediate Steps to Take

Upgrade Jira to version 7.13.3 or higher if using a version prior to this release.
For versions 8.0.0 to 8.0.4, update to version 8.0.4 or later.
If using versions 8.1.0 to 8.1.1, upgrade to version 8.1.1 or above.

Long-Term Security Practices

Regularly monitor and apply security patches provided by Atlassian.
Implement proper access controls and authentication mechanisms to prevent unauthorized access.

Patching and Updates

Ensure timely installation of software updates and security patches released by Atlassian to address this vulnerability.