Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-67107

Missing authentication checks in various administrative system import resources - CVE-2017-18101

XMLWordPrintable

      Various administrative external system import resources in Atlassian JIRA Server (including JIRA Core) before version 7.6.5, from version 7.7.0 before version 7.7.3, from version 7.8.0 before version 7.8.3 and before version 7.9.0 allow remote attackers to run import operations and to determine if an internal service exists through missing permission checks.

            [JRASERVER-67107] Missing authentication checks in various administrative system import resources - CVE-2017-18101

            set-jac-bot made changes -
            Fixed in Enterprise Release/s New: [Download 7.6|https://confluence.atlassian.com/enterprise/atlassian-enterprise-releases-948227420.html]
            Bugfix Automation Bot made changes -
            Minimum Version New: 7.06
            Andy Nguyen (Inactive) made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 399092 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow v2 [ 2835668 ] New: JAC Bug Workflow v3 [ 2925352 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Owen made changes -
            Symptom Severity Original: Major [ 14431 ] New: Severity 2 - Major [ 15831 ]
            Owen made changes -
            Workflow Original: JIRA Bug Workflow w Kanban v7 - Restricted [ 2655234 ] New: JAC Bug Workflow v2 [ 2835668 ]
            Status Original: Closed [ 6 ] New: Resolved [ 5 ]
            Kamil Kolonko made changes -
            Fix Version/s New: 7.6.6 [ 79690 ]
            Fix Version/s New: 7.7.4 [ 79791 ]
            Fix Version/s New: 7.8.4 [ 79794 ]
            Fix Version/s Original: 7.7.3 [ 78309 ]
            Fix Version/s Original: 7.6.5 [ 78515 ]
            Fix Version/s Original: 7.8.3 [ 78793 ]
            David Black made changes -
            Summary Original: Sanitised security issue 3e877d88a962d70e7ea481ff77cf780e723bc8e4d8a055be2dcf754aa68b4ed4 New: Missing authentication checks in various administrative system import resources - CVE-2017-18101
            David Black made changes -
            Labels Original: advisory advisory-released authentication basm bugbounty cvss-medium improper-authentication pse-request security triaged New: CVE-2017-18101 advisory advisory-released authentication basm bugbounty cvss-medium improper-authentication pse-request security triaged
            David Black made changes -
            Labels Original: advisory advisory-to-release authentication basm bugbounty cvss-medium improper-authentication pse-request security triaged New: advisory advisory-released authentication basm bugbounty cvss-medium improper-authentication pse-request security triaged

              Unassigned Unassigned
              security-metrics-bot Security Metrics Bot
              Affected customers:
              0 This affects my team
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: