VULNERABILITY INTELLIGENCE

CVE-2018-13391

CVSS score5.3 MEDIUM

EPSS probability1.80%

CISA KEVNot currently listed

Published2018-08-28

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

The ProfileLinkUserFormat component of Jira Server before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3 and from version 7.11.0 before version 7.11.2 allows remote attackers who can access & view an issue to obtain the email address of the reporter and assignee user of an issue despite the configured email visibility setting being set to hidden.

Weakness classification

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references

security@atlassian.com — Third Party Advisory, VDB Entry
security@atlassian.com — Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory