Uploaded image for project: 'Jira Platform Cloud'
  1. Jira Platform Cloud
  2. JRACLOUD-80948

Availability to disable the 'Share issue' function

XMLWordPrintable

    • 3
    • 13

    • Our product teams collect and evaluate feedback from a number of different sources. To learn more about how we use customer feedback in the planning process, check out our new feature policy.

      When a user shares a Jira issue with external users, 2 things happen:

      1. The user(s) will receive an email with the title of the issue/page shared in it and a link to what is being shared.
      2. If the user access settings allow it, and the user receiving the email has an email address that is not yet added to the site, they will also have the opportunity to add themselves to the site.

      For step 2, it is possible to prevent users from self-signing through the change in the User access settings: User invites, but step 1 can't be prevented so any user can use the share function and share the issue/page name and link, even if the user receiving the email does not actually have permissions to access the link received. This could be considered a form of data leak.

      The suggestion is to have the ability to entirely disable the 'Share issue' function from Issues or projects to external users.

            [JRACLOUD-80948] Availability to disable the 'Share issue' function

            SK added a comment - - edited

            This is a possible data exfiltration risk. It doesn't matter if users are internal or external. Up to 500 characters of data can be sent out using share button and to anyone in the world (any email address is allowed). Mitigations like users training is not enough to address auditing of such threats. This is not limited to confluence, even Jira has a share button.

             

            SK added a comment - - edited This is a possible data exfiltration risk. It doesn't matter if users are internal or external. Up to 500 characters of data can be sent out using share button and to anyone in the world (any email address is allowed). Mitigations like users training is not enough to address auditing of such threats. This is not limited to confluence, even Jira has a share button.  

            Richard Layes added a comment -

            More specifically, I would like to disable the ability to share a ticket from a Project to external users.

            Richard Layes added a comment - More specifically, I would like to disable the ability to share a ticket from a Project to external users.

              Unassigned Unassigned
              falfaro@atlassian.com Fabian A
              Votes:
              10 Vote for this issue
              Watchers:
              13 Start watching this issue

                Created:
                Updated: