Details
-
Suggestion
-
Resolution: Fixed
-
None
Description
Currently JIRA allows you to change system file paths at runtime.
While convenient, this allowed an attacker to elevate his/her stolen system admin access into a situation where he/her can execute arbitrary code.
A decision has been made to remove the ability to set the paths at run time. For new installations they will default to JIRA home directories.
For existing instances, the current paths will be used however the UI will not provide a way to change them to anything other than <jirahome>
See JRA-21400 for more details about the current security situation.
Attachments
Issue Links
- details
-
JRASERVER-21575 documentation on how to change the secure paths inside JIRA Home (PUBLISHED BUT MOST LIKELY NEED TO AMEND)
- Closed
- is duplicated by
-
JRASERVER-21879 NullPointerException when Switching between Projects or Boards
- Closed