• Type: Public Security Vulnerability
• Resolution: Fixed
• Priority: Low (View bug fix roadmap)
• Fix Version/s: 9.0.0
• Affects Version/s: 8.13.21, 8.20.9, 8.22.3
• Component/s: Security
• Labels:

  • advisory
  • advisory-released
  • dont-import
  • security
  • 🔢✅

[JRASERVER-73926] Rest API Endpoint Leaked Project Categories, Project categories, status categories, issue link types, priorities, and resolutions to Unauthorised users

Douglas Alves made changes - 03/May/2023 1:11 PM

Description

Original: Affected versions of Atlassian Jira Server and Data Center allows an Un-Authenticated attacker to view Project categories, status categories, issue link types, priorities, and resolutions via an Information Disclosure vulnerability on the following Endpoints:  * /rest/api/2/issueLinkType  * /rest/api/2/priority  * /rest/api/2/projectCategory  * /rest/api/2/resolution  * /rest/api/2/status  * /rest/api/2/statuscategory  * /rest/api/2/projectvalidate/key?key=   * /rest/api/2/jql/autocompletedata/   * /rest/api/latest/avatar/project/system 10/rest/api/2/field    * /rest/api/2/screens  * /rest/api/1.0/issues/2346583/ActionsAndOperations   *Affected versions:*  - version < 9.0.0 *Fixed versions:*  - 9.0.0  - For LTSes (tested on versions 8.13.x and 8.20.x) and versions 8.21+ to restrict anonymous access to the endpoint you need to disable feature flag aka provide {{<feature.flag>.disabled.}}  * (i) Steps to manage Dark Features can be found here: [How to manage dark features in Jira|https://confluence.atlassian.com/jirakb/how-to-manage-dark-features-in-jira-959286331.html] List of flags: ||*Endpoint*||*What changes*||*Feature flag*|| |/rest/api/2/issueLinkType|Anonymous access disabled completely|com.atlassian.jira.security.endpoint.anonymous.access.issueLinkType| |/rest/api/2/priority|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.anonymous.access.priority| |/rest/api/2/projectCategory|Anonymous access disabled completely|com.atlassian.jira.security.endpoint.anonymous.access.projectCategory| |/rest/api/2/resolution|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.anonymous.access.resolution| |/rest/api/2/jql/autocompletedata/|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.non.browse.projects.access.autocompletedata| |/rest/api/latest/avatar/project/system|Anonymous access disabled completly|com.atlassian.jira.security.endpoint.non.admin.access.avatar.system| |/rest/api/2/field|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.non.browse.projects.access.fields| |/rest/api/2/screens|Only admins have access to this endpoint|com.atlassian.jira.security.endpoint.non.admin.access.screens|

New: Affected versions of Atlassian Jira Server and Data Center allows an Un-Authenticated attacker to view Project categories, status categories, issue link types, priorities, and resolutions via an Information Disclosure vulnerability on the following Endpoints:  * /rest/api/2/issueLinkType  * /rest/api/2/priority  * /rest/api/2/projectCategory  * /rest/api/2/resolution  * /rest/api/2/status  * /rest/api/2/statuscategory  * /rest/api/2/projectvalidate/key?key=   * /rest/api/2/jql/autocompletedata/   * /rest/api/latest/avatar/project/system 10/rest/api/2/field    * /rest/api/2/screens  * /rest/api/1.0/issues/2346583/ActionsAndOperations   *Affected versions:*  - version < 9.0.0 *Fixed versions:*  - 9.0.0  - For LTSes (tested on versions 8.13.x and 8.20.x) and versions 8.21+ to restrict anonymous access to the endpoint you need to disable feature flag aka provide {{<feature.flag>.{*}disabled{*}.}}  * (i) Steps to manage Dark Features can be found here: [How to manage dark features in Jira|https://confluence.atlassian.com/jirakb/how-to-manage-dark-features-in-jira-959286331.html] List of flags: ||*Endpoint*||*What changes*||*Feature flag*|| |/rest/api/2/issueLinkType|Anonymous access disabled completely|com.atlassian.jira.security.endpoint.anonymous.access.issueLinkType| |/rest/api/2/priority|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.anonymous.access.priority| |/rest/api/2/projectCategory|Anonymous access disabled completely|com.atlassian.jira.security.endpoint.anonymous.access.projectCategory| |/rest/api/2/resolution|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.anonymous.access.resolution| |/rest/api/2/jql/autocompletedata/|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.non.browse.projects.access.autocompletedata| |/rest/api/latest/avatar/project/system|Anonymous access disabled completly|com.atlassian.jira.security.endpoint.non.admin.access.avatar.system| |/rest/api/2/field|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.non.browse.projects.access.fields| |/rest/api/2/screens|Only admins have access to this endpoint|com.atlassian.jira.security.endpoint.non.admin.access.screens|

Douglas Alves made changes - 03/May/2023 1:10 PM

Description

Original: Affected versions of Atlassian Jira Server and Data Center allows an Un-Authenticated attacker to view Project categories, status categories, issue link types, priorities, and resolutions via an Information Disclosure vulnerability on the following Endpoints:  * /rest/api/2/issueLinkType  * /rest/api/2/priority  * /rest/api/2/projectCategory  * /rest/api/2/resolution  * /rest/api/2/status  * /rest/api/2/statuscategory  * /rest/api/2/projectvalidate/key?key=   * /rest/api/2/jql/autocompletedata/   * /rest/api/latest/avatar/project/system 10/rest/api/2/field    * /rest/api/2/screens  * /rest/api/1.0/issues/2346583/ActionsAndOperations   *Affected versions:*  - version < 9.0.0 *Fixed versions:*  - 9.0.0  - On Jira 8.21+ to restrict anonymous access to the endpoint you need to disable feature flag aka provide {{<feature.flag>.disabled.}}  * (i) Steps to manage Dark Features can be found here: [How to manage dark features in Jira|https://confluence.atlassian.com/jirakb/how-to-manage-dark-features-in-jira-959286331.html] List of flags: ||*Endpoint*||*What changes*||*Feature flag*|| |/rest/api/2/issueLinkType|Anonymous access disabled completely|com.atlassian.jira.security.endpoint.anonymous.access.issueLinkType| |/rest/api/2/priority|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.anonymous.access.priority| |/rest/api/2/projectCategory|Anonymous access disabled completely|com.atlassian.jira.security.endpoint.anonymous.access.projectCategory| |/rest/api/2/resolution|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.anonymous.access.resolution| |/rest/api/2/jql/autocompletedata/|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.non.browse.projects.access.autocompletedata| |/rest/api/latest/avatar/project/system|Anonymous access disabled completly|com.atlassian.jira.security.endpoint.non.admin.access.avatar.system| |/rest/api/2/field|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.non.browse.projects.access.fields| |/rest/api/2/screens|Only admins have access to this endpoint|com.atlassian.jira.security.endpoint.non.admin.access.screens|

New: Affected versions of Atlassian Jira Server and Data Center allows an Un-Authenticated attacker to view Project categories, status categories, issue link types, priorities, and resolutions via an Information Disclosure vulnerability on the following Endpoints:  * /rest/api/2/issueLinkType  * /rest/api/2/priority  * /rest/api/2/projectCategory  * /rest/api/2/resolution  * /rest/api/2/status  * /rest/api/2/statuscategory  * /rest/api/2/projectvalidate/key?key=   * /rest/api/2/jql/autocompletedata/   * /rest/api/latest/avatar/project/system 10/rest/api/2/field    * /rest/api/2/screens  * /rest/api/1.0/issues/2346583/ActionsAndOperations   *Affected versions:*  - version < 9.0.0 *Fixed versions:*  - 9.0.0  - For LTSes (tested on versions 8.13.x and 8.20.x) and versions 8.21+ to restrict anonymous access to the endpoint you need to disable feature flag aka provide {{<feature.flag>.disabled.}}  * (i) Steps to manage Dark Features can be found here: [How to manage dark features in Jira|https://confluence.atlassian.com/jirakb/how-to-manage-dark-features-in-jira-959286331.html] List of flags: ||*Endpoint*||*What changes*||*Feature flag*|| |/rest/api/2/issueLinkType|Anonymous access disabled completely|com.atlassian.jira.security.endpoint.anonymous.access.issueLinkType| |/rest/api/2/priority|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.anonymous.access.priority| |/rest/api/2/projectCategory|Anonymous access disabled completely|com.atlassian.jira.security.endpoint.anonymous.access.projectCategory| |/rest/api/2/resolution|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.anonymous.access.resolution| |/rest/api/2/jql/autocompletedata/|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.non.browse.projects.access.autocompletedata| |/rest/api/latest/avatar/project/system|Anonymous access disabled completly|com.atlassian.jira.security.endpoint.non.admin.access.avatar.system| |/rest/api/2/field|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.non.browse.projects.access.fields| |/rest/api/2/screens|Only admins have access to this endpoint|com.atlassian.jira.security.endpoint.non.admin.access.screens|

Thales Santos made changes - 11/Apr/2023 8:01 AM

Remote Link

New: This issue links to "Page (Confluence)" [ 748809 ]

Thales Santos made changes - 04/Apr/2023 8:06 AM

Remote Link

New: This issue links to "Page (Confluence)" [ 747138 ]

Bruno made changes - 15/Mar/2023 9:17 PM

Description

Original: Affected versions of Atlassian Jira Server and Data Center allows an Un-Authenticated attacker to view Project categories, status categories, issue link types, priorities, and resolutions via an Information Disclosure vulnerability on the following Endpoints:  * /rest/api/2/issueLinkType  * /rest/api/2/priority  * /rest/api/2/projectCategory  * /rest/api/2/resolution  * /rest/api/2/status  * /rest/api/2/statuscategory  * /rest/api/2/projectvalidate/key?key=   * /rest/api/2/jql/autocompletedata/   * /rest/api/latest/avatar/project/system 10/rest/api/2/field    * /rest/api/2/screens  * /rest/api/1.0/issues/2346583/ActionsAndOperations   *Affected versions:*  - version < 9.0.0 *Fixed versions:*  - 9.0.0  - On Jira 8.x to restrict anonymous access to the endpoint you need to disable feature flag aka provide {{<feature.flag>.disabled.}}  * (i) Steps to manage Dark Features can be found here: [How to manage dark features in Jira|https://confluence.atlassian.com/jirakb/how-to-manage-dark-features-in-jira-959286331.html] List of flags: ||*Endpoint*||*What changes*||*Feature flag*|| |/rest/api/2/issueLinkType|Anonymous access disabled completely|com.atlassian.jira.security.endpoint.anonymous.access.issueLinkType| |/rest/api/2/priority|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.anonymous.access.priority| |/rest/api/2/projectCategory|Anonymous access disabled completely|com.atlassian.jira.security.endpoint.anonymous.access.projectCategory| |/rest/api/2/resolution|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.anonymous.access.resolution| |/rest/api/2/jql/autocompletedata/|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.non.browse.projects.access.autocompletedata| |/rest/api/latest/avatar/project/system|Anonymous access disabled completly|com.atlassian.jira.security.endpoint.non.admin.access.avatar.system| |/rest/api/2/field|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.non.browse.projects.access.fields| |/rest/api/2/screens|Only admins have access to this endpoint|com.atlassian.jira.security.endpoint.non.admin.access.screens|

New: Affected versions of Atlassian Jira Server and Data Center allows an Un-Authenticated attacker to view Project categories, status categories, issue link types, priorities, and resolutions via an Information Disclosure vulnerability on the following Endpoints:  * /rest/api/2/issueLinkType  * /rest/api/2/priority  * /rest/api/2/projectCategory  * /rest/api/2/resolution  * /rest/api/2/status  * /rest/api/2/statuscategory  * /rest/api/2/projectvalidate/key?key=   * /rest/api/2/jql/autocompletedata/   * /rest/api/latest/avatar/project/system 10/rest/api/2/field    * /rest/api/2/screens  * /rest/api/1.0/issues/2346583/ActionsAndOperations   *Affected versions:*  - version < 9.0.0 *Fixed versions:*  - 9.0.0  - On Jira 8.21+ to restrict anonymous access to the endpoint you need to disable feature flag aka provide {{<feature.flag>.disabled.}}  * (i) Steps to manage Dark Features can be found here: [How to manage dark features in Jira|https://confluence.atlassian.com/jirakb/how-to-manage-dark-features-in-jira-959286331.html] List of flags: ||*Endpoint*||*What changes*||*Feature flag*|| |/rest/api/2/issueLinkType|Anonymous access disabled completely|com.atlassian.jira.security.endpoint.anonymous.access.issueLinkType| |/rest/api/2/priority|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.anonymous.access.priority| |/rest/api/2/projectCategory|Anonymous access disabled completely|com.atlassian.jira.security.endpoint.anonymous.access.projectCategory| |/rest/api/2/resolution|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.anonymous.access.resolution| |/rest/api/2/jql/autocompletedata/|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.non.browse.projects.access.autocompletedata| |/rest/api/latest/avatar/project/system|Anonymous access disabled completly|com.atlassian.jira.security.endpoint.non.admin.access.avatar.system| |/rest/api/2/field|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.non.browse.projects.access.fields| |/rest/api/2/screens|Only admins have access to this endpoint|com.atlassian.jira.security.endpoint.non.admin.access.screens|

Filipi Lima made changes - 23/Feb/2023 6:57 PM

Description

Original: Affected versions of Atlassian Jira Server and Data Center allows an Un-Authenticated attacker to view Project categories, status categories, issue link types, priorities, and resolutions via an Information Disclosure vulnerability on the following Endpoints:  * /rest/api/2/issueLinkType  * /rest/api/2/priority  * /rest/api/2/projectCategory  * /rest/api/2/resolution  * /rest/api/2/status  * /rest/api/2/statuscategory  * /rest/api/2/projectvalidate/key?key=   * /rest/api/2/jql/autocompletedata/   * /rest/api/latest/avatar/project/system 10/rest/api/2/field    * /rest/api/2/screens  * /rest/api/1.0/issues/2346583/ActionsAndOperations   *Affected versions:*  - version < 9.0.0 *Fixed versions:*  - 9.0.0  - On Jira 8.x to restrict anonymous access to the endpoint you need to disable feature flag aka provide {{<feature.flag>.disabled.}} {{List of flags:}} ||*Endpoint*||*What changes*||*Feature flag*|| |/rest/api/2/issueLinkType|Anonymous access disabled completely|com.atlassian.jira.security.endpoint.anonymous.access.issueLinkType| |/rest/api/2/priority|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.anonymous.access.priority| |/rest/api/2/projectCategory|Anonymous access disabled completely|com.atlassian.jira.security.endpoint.anonymous.access.projectCategory| |/rest/api/2/resolution|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.anonymous.access.resolution| |/rest/api/2/jql/autocompletedata/|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.non.browse.projects.access.autocompletedata| |/rest/api/latest/avatar/project/system|Anonymous access disabled completly|com.atlassian.jira.security.endpoint.non.admin.access.avatar.system| |/rest/api/2/field|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.non.browse.projects.access.fields| |/rest/api/2/screens|Only admins have access to this endpoint|com.atlassian.jira.security.endpoint.non.admin.access.screens|

New: Affected versions of Atlassian Jira Server and Data Center allows an Un-Authenticated attacker to view Project categories, status categories, issue link types, priorities, and resolutions via an Information Disclosure vulnerability on the following Endpoints:  * /rest/api/2/issueLinkType  * /rest/api/2/priority  * /rest/api/2/projectCategory  * /rest/api/2/resolution  * /rest/api/2/status  * /rest/api/2/statuscategory  * /rest/api/2/projectvalidate/key?key=   * /rest/api/2/jql/autocompletedata/   * /rest/api/latest/avatar/project/system 10/rest/api/2/field    * /rest/api/2/screens  * /rest/api/1.0/issues/2346583/ActionsAndOperations   *Affected versions:*  - version < 9.0.0 *Fixed versions:*  - 9.0.0  - On Jira 8.x to restrict anonymous access to the endpoint you need to disable feature flag aka provide {{<feature.flag>.disabled.}}  * (i) Steps to manage Dark Features can be found here: [How to manage dark features in Jira|https://confluence.atlassian.com/jirakb/how-to-manage-dark-features-in-jira-959286331.html] List of flags: ||*Endpoint*||*What changes*||*Feature flag*|| |/rest/api/2/issueLinkType|Anonymous access disabled completely|com.atlassian.jira.security.endpoint.anonymous.access.issueLinkType| |/rest/api/2/priority|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.anonymous.access.priority| |/rest/api/2/projectCategory|Anonymous access disabled completely|com.atlassian.jira.security.endpoint.anonymous.access.projectCategory| |/rest/api/2/resolution|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.anonymous.access.resolution| |/rest/api/2/jql/autocompletedata/|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.non.browse.projects.access.autocompletedata| |/rest/api/latest/avatar/project/system|Anonymous access disabled completly|com.atlassian.jira.security.endpoint.non.admin.access.avatar.system| |/rest/api/2/field|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.non.browse.projects.access.fields| |/rest/api/2/screens|Only admins have access to this endpoint|com.atlassian.jira.security.endpoint.non.admin.access.screens|

Mandeep Jadon made changes - 21/Feb/2023 3:40 PM

Remote Link

New: This issue links to "Page (Confluence)" [ 733362 ]

Filip Nowak made changes - 13/Feb/2023 8:51 AM

Description

Original: Affected versions of Atlassian Jira Server and Data Center allows an Un-Authenticated attacker to view Project categories, status categories, issue link types, priorities, and resolutions via an Information Disclosure vulnerability on the following Endpoints:  * /rest/api/2/issueLinkType  * /rest/api/2/priority  * /rest/api/2/projectCategory  * /rest/api/2/resolution  * /rest/api/2/status  * /rest/api/2/statuscategory  * /rest/api/2/projectvalidate/key?key=   * /rest/api/2/jql/autocompletedata/   * /rest/api/latest/avatar/project/system 10/rest/api/2/field    * /rest/api/2/screens  * /rest/api/1.0/issues/2346583/ActionsAndOperations   *Affected versions:*  - version < 9.0.0 *Fixed versions:*  - 9.0.0  - On Jira 8.x to restrict anonymous access to the endpoint you need to disable [feature flag|https://hello.atlassian.net/wiki/spaces/JIRASERVER/pages/1338045175/Endpoints+statuses+-+simplified+list] aka provide {{<feature.flag>.disabled}}

New: Affected versions of Atlassian Jira Server and Data Center allows an Un-Authenticated attacker to view Project categories, status categories, issue link types, priorities, and resolutions via an Information Disclosure vulnerability on the following Endpoints:  * /rest/api/2/issueLinkType  * /rest/api/2/priority  * /rest/api/2/projectCategory  * /rest/api/2/resolution  * /rest/api/2/status  * /rest/api/2/statuscategory  * /rest/api/2/projectvalidate/key?key=   * /rest/api/2/jql/autocompletedata/   * /rest/api/latest/avatar/project/system 10/rest/api/2/field    * /rest/api/2/screens  * /rest/api/1.0/issues/2346583/ActionsAndOperations   *Affected versions:*  - version < 9.0.0 *Fixed versions:*  - 9.0.0  - On Jira 8.x to restrict anonymous access to the endpoint you need to disable feature flag aka provide {{<feature.flag>.disabled.}} {{List of flags:}} ||*Endpoint*||*What changes*||*Feature flag*|| |/rest/api/2/issueLinkType|Anonymous access disabled completely|com.atlassian.jira.security.endpoint.anonymous.access.issueLinkType| |/rest/api/2/priority|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.anonymous.access.priority| |/rest/api/2/projectCategory|Anonymous access disabled completely|com.atlassian.jira.security.endpoint.anonymous.access.projectCategory| |/rest/api/2/resolution|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.anonymous.access.resolution| |/rest/api/2/jql/autocompletedata/|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.non.browse.projects.access.autocompletedata| |/rest/api/latest/avatar/project/system|Anonymous access disabled completly|com.atlassian.jira.security.endpoint.non.admin.access.avatar.system| |/rest/api/2/field|Anonymous access blocked only when there is no projects available for anonymous users|com.atlassian.jira.security.endpoint.non.browse.projects.access.fields| |/rest/api/2/screens|Only admins have access to this endpoint|com.atlassian.jira.security.endpoint.non.admin.access.screens|

Sen Geronimo made changes - 10/Feb/2023 6:49 AM

Component/s

New: Security [ 68109 ]

Manish Soni (Inactive) made changes - 10/Feb/2023 6:49 AM

Labels

Original: advisory advisory-to-release dont-import security 🔢✅

New: advisory advisory-released dont-import security 🔢✅

Load more older history items