Description
By accessing the endpoint /secure/popups/UserPickerBrowser.jspa?max=10, an unauthenticated attack can retrieve the Jira's users.
Remediation
Consider restricting unauthenticated access to this endpoint.
References
Related Vulnerabilities
phpMyAdmin Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-2206)
WordPress Plugin Advanced Woo Search Information Disclosure (1.99)
Minify arbitrary file disclosure
[Possible] Database Connection String Detected
WordPress Plugin BulletProof Security Information Disclosure (5.1)