[JRASERVER-67107] Missing authentication checks in various administrative system import resources - CVE-2017-18101 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Medium (View bug fix roadmap)
Fix Version/s: 7.9.0, 7.6.6, 7.7.4, 7.8.4
Affects Version/s: 7.6.0, 7.7.0, 7.8.0
Component/s: Backup & Restore (non-migration)
Labels:

Fixed in Long Term Support Release/s:

Download 7.6
Introduced in Version:
7.06
Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

Various administrative external system import resources in Atlassian JIRA Server (including JIRA Core) before version 7.6.5, from version 7.7.0 before version 7.7.3, from version 7.8.0 before version 7.8.3 and before version 7.9.0 allow remote attackers to run import operations and to determine if an internal service exists through missing permission checks.

mentioned in: Page Failed to load

No work has yet been logged on this issue.

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Affected customers:: 0 This affects my team

Watchers:: 5 Start watching this issue

Created:: 10/Apr/2018 3:28 AM

Updated:: 22/May/2020 8:25 AM

Resolved:: 10/Apr/2018 3:28 AM

Details

Description

Attachments

Issue Links

Forms

Activity

[JRASERVER-67107] Missing authentication checks in various administrative system import resources - CVE-2017-18101

People

Dates