-
Bug
-
Resolution: Fixed
-
Low
-
7.13.3, 8.2.4
-
None
-
7.13
-
1
-
Severity 2 - Major
-
Issue Summary
Permissions are set to allow a user that is not signed in to create a ticket and assign the report through the user picker. Recent releases of Jira prevent this action unless the user signs in.
Environment
Jira 7.13.3+
Steps to Reproduce
- Set up a new install of Jira 7.12.x
- Set the global permission "browse users" to anyone and the project permissions "create issues," "modify reporter," "browse projects," & "assign issues"
- Log out
- Attempt to create an issue and assign it to a user in the instance
- Complete issue creation
- Set up a new install of Jira 7.13.5
- Grant the same permissions
- Log out
- Attempt to create an issue and assign it to a user
Expected Results
Same results as 7.12.x
Actual Results
An error prompting for sign in (401 error)
Notes
An unintended symptom of https://jira.atlassian.com/browse/JRASERVER-69242
Workaround
Currently, there is no known workaround for this behavior. A workaround will be added here when available.
- is caused by
-
JRASERVER-69242 Information disclosure in the /rest/api/2/user/picker rest resource - CVE-2019-3403
- Closed
- is duplicated by
-
JSWSERVER-20459 Pre-configured anonymous access to user picker breaks upon upgrading to Jira 8.4+
- Closed
- mentioned in
-
Page Loading...
- relates to
-
RAID-1708 Loading...