description: Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission to view groups via an Information Disclosure vulnerability in the browsegroups.action endpoint. The affected versions are before version 4.22.2.
problem types: Information Disclosure
affected:
{
product: Jira Service Management Server
vendor: Atlassian
versions:
lessThan: 4.22.2, status: affected, version: unspecified, versionType: custom
}
{
product: Jira Service Management Data Center
vendor: Atlassian
versions:
lessThan: 4.22.2, status: affected, version: unspecified, versionType: custom
}
