Uploaded image for project: 'Jira Server and Data Center'
  1. Jira Server and Data Center
  2. JRASERVER-21232

The system paths are to be locked down to the JIRA Home directory

    XMLWordPrintable

    Details

    • Feedback Policy:
      We collect Jira feedback from various sources, and we evaluate what we've collected when planning our product roadmap. To understand how this piece of feedback will be reviewed, see our Implementation of New Features Policy.

      Description

      Currently JIRA allows you to change system file paths at runtime.

      While convenient, this allowed an attacker to elevate his/her stolen system admin access into a situation where he/her can execute arbitrary code.

      A decision has been made to remove the ability to set the paths at run time. For new installations they will default to JIRA home directories.

      For existing instances, the current paths will be used however the UI will not provide a way to change them to anything other than <jirahome>

      See JRA-21400 for more details about the current security situation.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              bbaker ɹǝʞɐq pɐɹq
              Reporter:
              bbaker ɹǝʞɐq pɐɹq
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: