Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-71317

Browsing serverInfo anonymously gives version number information

XMLWordPrintable

      Issue Summary

      Browsing serverInfo anonymously gives version number information

      Steps to Reproduce

      1. curl https://<jira-server>/rest/api/2/serverInfo
      2. navigate to https://<jira-server>/rest/api/2/serverInfo in a browser

      Expected Results

      Fail to connect

      Actual Results

      The below exception is thrown in the xxxxxxx.log file:

      baseUrl	"https://ocean.agilecraft.xyz"
version	"8.5.5"
versionNumbers	
0	8
1	5
2	5
deploymentType	"Server"
buildNumber	805005
buildDate	"2020-06-05T00:00:00.000+0000"
databaseBuildNumber	805005
scmInfo	"a6982cff65627fb3fa50669b736095827f0ea0a7"
serverTitle	"JIRA"

      Workaround

      Possible API gateway/proxy setup or whitelist IPs that are trusted

       

          Form Name

            [JRASERVER-71317] Browsing serverInfo anonymously gives version number information

            Matt Doar (Adaptavist) added a comment -

            Making it non-anonymous is annoying but good because it will slow down scripts that are scanning networks looking for vulnerable versions of Jira. So, I guess this should be done

            Matt Doar (Adaptavist) added a comment - Making it non-anonymous is annoying but good because it will slow down scripts that are scanning networks looking for vulnerable versions of Jira. So, I guess this should be done

            Tobias Viehweger added a comment -

            Is this really a bug though? We rely on this information in our apps to determine which logic to use to connect to different versions of Jira DC? This also seems to be broken in 10.3, as it always throws a 401 when trying to access this anonymously. The same endpoint can also be accessed in Jira Cloud anonymously.

            Tobias Viehweger added a comment - Is this really a bug though? We rely on this information in our apps to determine which logic to use to connect to different versions of Jira DC? This also seems to be broken in 10.3, as it always throws a 401 when trying to access this anonymously. The same endpoint can also be accessed in Jira Cloud anonymously.

              9e3a0496a19c Jakub Sildatk
              a4eb12018180 James McCulley
              Affected customers:
              2 This affects my team
              Watchers:
              10 Start watching this issue

                Created:
                Updated:
                Resolved: