CVE-2021-39122: 
JIRA vulnerability analysis and mitigation

Atlassian Jira Server and Data Center were affected by an Information Disclosure vulnerability (CVE-2021-39122) that allowed anonymous remote attackers to view users' emails through the /rest/api/2/search endpoint. The vulnerability affected versions before 8.5.13, versions 8.6.0 to 8.13.5, and versions 8.14.0 to 8.15.1 (Atlassian Advisory, NVD).

The vulnerability received a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This scoring indicates that the vulnerability is network-accessible, requires low attack complexity, needs no privileges, and can result in low confidentiality impact without affecting integrity or availability (NVD).

The primary impact of this vulnerability is the unauthorized disclosure of user email addresses to anonymous attackers, potentially compromising user privacy and enabling further social engineering attacks (Atlassian Advisory).

Atlassian has released fixed versions to address this vulnerability. Users should upgrade to version 8.5.13, 8.13.5, 8.15.1, or 8.16.0 depending on their current version track (Atlassian Advisory).