CVE-2019-3403: Jira user picker REST endpoint allows username enumeration

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

medium priorityThe flaw is only an information disclosure with medium CVSS, but unauthenticated reachability and very high EPSS make it a practical precursor to credential attacks.

What it is

The /rest/api/2/user/picker REST resource in Jira performs an incorrect authorization check, letting unauthenticated remote attackers enumerate valid usernames. Username lists feed credential-stuffing, password spraying and social engineering against Jira and connected Atlassian accounts, so the leak matters even though it is only an information disclosure.

Impact

An attacker gains a confirmed list of valid Jira usernames, which lowers the cost of follow-on authentication attacks and targeted phishing. No data beyond account existence is exposed by this flaw itself.

Attack surface

Reachable over the network through the Jira REST API at /rest/api/2/user/picker; the CVSS vector shows no privileges and no user interaction required, so the endpoint can be queried directly by an unauthenticated client.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at roughly 0.53 probability (99th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Upgrade Jira Server to 7.13.3, 8.0.4 or 8.1.1 (or later) as fixed by the vendor advisory JRASERVER-69242.
• If immediate patching is not possible, restrict or block external access to /rest/api/2/user/picker at the reverse proxy or WAF.
• Require authentication for Jira REST endpoints where feasible and review anonymous access settings.
• Monitor and rate-limit repeated user picker queries from single source addresses.

Detection

• Alert on high-volume or sequential requests to /rest/api/2/user/picker from a single IP or session.
• Baseline normal user picker traffic and flag spikes or off-hours enumeration patterns.
• Correlate enumeration attempts with subsequent failed logins or password-spray activity against Jira accounts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.