Vulnerability record · CVE-2020-14181 · published 17 September 2020

CVE-2020-14181: Atlassian Jira Server and Data Center user enumeration via ViewUserHover.jspa

Atlassian · Data Center

Jira Server and Data Center expose an information disclosure flaw in the /ViewUserHover.jspa endpoint that lets an unauthenticated user enumerate valid usernames. Affected versions are before 7.13.6, 8.0.0 through 8.5.6, and 8.6.0 through 8.11.x (before 8.12.0). The leak matters because harvested account names feed credential attacks and social engineering against the Jira instance.

5.3 CVSS 3.1 Medium EPSS 100% · top 0.1% CWE-200 · Information exposure

5.3CVSS 3.1 base score, v2 5.0

100%EPSS exploitation probability, 30 days

NoNot in CISA KEV

3Affected product versions listed by NVD

4References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is trivially reachable without authentication and has near-maximum EPSS with public exploit code, though it only discloses usernames.

What it is

Impact

An attacker gains a list of valid Jira usernames without authenticating. That list enables targeted password guessing, phishing, and mapping of privileged accounts.

Attack surface

Reached over the network by sending requests to the /ViewUserHover.jspa endpoint; the CVSS vector shows PR:N and UI:N, so no authentication or user interaction is required.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.99603, 99.947th percentile) and public exploit references exist, indicating active and easy exploitation.

What to do

Upgrade Jira Server/Data Center to 7.13.6, 8.5.7, 8.12.0 or later as applicable.
If immediate patching is not possible, restrict or block external access to /ViewUserHover.jspa at the reverse proxy or WAF.
Limit Jira exposure to trusted networks or VPN rather than the public internet.
Monitor and rate-limit unauthenticated requests to Jira endpoints to slow enumeration attempts.

Detection

Alert on high-volume or sequential requests to /ViewUserHover.jspa from a single source.
Baseline normal request rates to Jira user-lookup endpoints and flag deviations.
Correlate enumeration bursts with subsequent failed login attempts against Jira.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Data Center Atlassian

Jira Atlassian

Jira Server Atlassian

References

Link	Tags
http://packetstormsecurity.com/files/161730/Atlassian-JIRA-8.11.1-User-Enumeration.html	ExploitThird Party AdvisoryVDB Entry
https://jira.atlassian.com/browse/JRASERVER-71560	Issue TrackingVendor Advisory
http://packetstormsecurity.com/files/161730/Atlassian-JIRA-8.11.1-User-Enumeration.html	ExploitThird Party AdvisoryVDB Entry
https://jira.atlassian.com/browse/JRASERVER-71560	Issue TrackingVendor Advisory

Track CVE-2020-14181 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-11581Atlassian Jira Server and Data Center server-side template injectionJira Server and Data Center contain a server-side template injection flaw in the ContactAdministrators and SendBulkMail actions. An attacker can inje…KEVEPSS 85%analysed9 Aug 2019 5.3CVE-2021-26086Atlassian Jira Server and Data Center path traversal file readJira Server and Data Center contain a path traversal flaw in the /WEB-INF/web.xml endpoint that lets remote attackers read particular files. The affe…KEVEPSS 100%analysed16 Aug 2021 9.8CVE-2022-26136Atlassian bamboo improper authentication vulnerabilityA vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps…EPSS 5.4%20 Jul 2022 9.8CVE-2022-0540Atlassian Jira Seraph authentication bypass via crafted HTTP requestJira Server, Data Center and Jira Service Management contain an authentication bypass in the Seraph component, reachable by sending a specially craft…EPSS 88%analysed20 Apr 2022 9.8CVE-2020-14172Atlassian jira deserialization of untrusted data vulnerabilityThis issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. Th…EPSS 2.5%3 Jul 2020 9.8CVE-2019-20409Atlassian jira injection vulnerabilityThe way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote…EPSS 2.5%23 Jun 2020 9.8CVE-2017-5983Atlassian jira deserialization of untrusted data vulnerabilityThe JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers…EPSS 16%10 Apr 2017 9.1CVE-2012-2926Atlassian JIRA and related products XML parser file read and DoSMultiple Atlassian products (JIRA, Confluence, FishEye, Crucible, Bamboo, Crowd) fail to properly restrict the capabilities of third-party XML parser…EPSS 66%analysed22 May 2012

Source: NIST National Vulnerability Database (record CVE-2020-14181), CISA KEV, FIRST EPSS (scores of 2026-09-22). This page is refreshed as NVD updates the record.