{"id":"CVE-2020-14181","published":"2020-09-17T00:35:13Z","modified":"2024-09-16T21:57:12Z","title":"Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an…","vendor":"Atlassian","product":"Jira Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"Atlassian","product":"Jira Server","versions":[">= unspecified, < 7.13.6",">= 8.0.0, < unspecified",">= unspecified, < 8.5.7",">= 8.6.0, < unspecified",">= unspecified, < 8.12.0"]}],"description":{"text":"Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.","provenance":"source","from":"CVE.org"},"summary":{"text":"An information disclosure flaw in the /ViewUserHover.jspa endpoint of Atlassian Jira Server and Data Center allows user enumeration. An unauthenticated attacker with network access to the affected Jira instance can enumerate users through that endpoint, with no authentication or user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:16:06Z"},"cvss":null,"epss":{"score":0.99603,"percentile":0.99947,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"Proof Point Emerging Exploit list","url":"https://otx.alienvault.com/pulse/6399fdc966948f6b537b9762","created":"2022-12-14"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://jira.atlassian.com/browse/JRASERVER-71560","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/161730/Atlassian-JIRA-8.11.1-User-Enumeration.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-6338","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-6338","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":49633,"url":"https://www.exploit-db.com/exploits/49633","title":"Atlassian JIRA 8.11.1 - User Enumeration","type":"webapps","platform":"multiple","date":"2021-03-10","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2021-03-10"},"pocGithub":{"count":3,"skipped":0,"earliest":"2020-09-15","earliestUrl":"https://github.com/und3sc0n0c1d0/UserEnumJira","repos":[{"name":"Rival420/CVE-2020-14181","url":"https://github.com/Rival420/CVE-2020-14181","stars":8,"created":"2020-10-26"},{"name":"bk-rao/CVE-2020-14181","url":"https://github.com/bk-rao/CVE-2020-14181","stars":2,"created":"2021-02-05"},{"name":"und3sc0n0c1d0/UserEnumJira","url":"https://github.com/und3sc0n0c1d0/UserEnumJira","stars":1,"created":"2020-09-15"}]},"metasploit":[{"name":"Jira Users Enumeration","module":"auxiliary/scanner/http/jira_user_enum","type":"auxiliary","disclosureDate":"2020-08-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/jira_user_enum.rb"}],"nuclei":[{"id":"CVE-2020-14181","name":"Jira Server and Data Center - Information Disclosure","severity":"medium","path":"http/cves/2020/CVE-2020-14181.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14181.yaml"}],"first":{"date":"2020-08-16","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/jira_user_enum.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/161730/Atlassian-JIRA-8.11.1-User-Enumeration.html"],"flow":[],"timeline":[{"date":"2020-08-16","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2020-09-15, Exploit-DB 2021-03-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/jira_user_enum.rb","provenance":"source"},{"date":"2020-09-17","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-14181","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":25.7,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9995"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 NVD exploit link; 3 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}