• Type: Public Security Vulnerability
• Resolution: Fixed
• Priority: Low
• Fix Version/s: 4.21.0, 4.20.2
• Affects Version/s: 4.20.0
• Component/s: None
• Labels:

  • advisory
  • advisory-to-release
  • dont-import
  • security

[JSDSERVER-10983] Import source configuration information is leaked via the Insight Import Source feature - CVE-2021-43950

Sam Xu made changes - 25/Feb/2022 12:12 AM

Fix Version/s

New: 4.20.2 [ 98290 ]

Security Metrics Bot made changes - 20/Feb/2022 8:28 PM

CVE ID

New: CVE-2021-43950

Collapse comment: klaus zerwes added a comment - 17/Feb/2022 10:36 PM

klaus zerwes added a comment - 17/Feb/2022 10:36 PM

at least some information regarding the LTS releases would be appreciated ...

Expand comment: klaus zerwes added a comment - 17/Feb/2022 10:36 PM

klaus zerwes added a comment - 17/Feb/2022 10:36 PM at least some information regarding the LTS releases would be appreciated ...

AB made changes - 15/Feb/2022 3:08 AM

Resolution		New: Fixed [ 1 ]
Security	Original: Atlassian Staff [ 10750 ]
Status	Original: Draft [ 12872 ]	New: Published [ 12873 ]

AB made changes - 15/Feb/2022 3:08 AM

Summary

Original: Import source configuration information is leaked via the Insight Import Source feature - CVE registration for this issue is already in progress

New: Import source configuration information is leaked via the Insight Import Source feature - CVE-2021-43950

AB made changes - 10/Feb/2022 12:48 AM

Summary

Original: Import source configuration information is leaked via the Insight Import Source feature

New: Import source configuration information is leaked via the Insight Import Source feature - CVE registration for this issue is already in progress

AB made changes - 10/Feb/2022 12:47 AM

Description

Original: Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with administrator privileges to view import source configuration information via a Broken Access Control vulnerability in the Insight Import Source feature. The affected versions are before version 4.21.0. *Affected versions:*  * version < 4.21.0 *Fixed versions:*  * 4.21.0

New: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source configuration information via a Broken Access Control vulnerability in the Insight Import Source feature. The affected versions are before version 4.21.0. *Affected versions:*  * version < 4.21.0 *Fixed versions:*  * 4.21.0

Collapse comment: AB added a comment - 06/Jan/2022 1:26 AM, Edited by AB - 10/Feb/2022 12:47 AM

AB added a comment - 06/Jan/2022 1:26 AM - edited

This is an independent assessment and you should evaluate its applicability to your own IT environment.

CVSS v3 score: 4.3 => Medium severity

Exploitability Metrics

Attack Vector	Network
Attack Complexity	Low
Privileges Required	Low
User Interaction	None

Scope Metric

Scope	Unchanged

Impact Metrics

Confidentiality	Low
Integrity	None
Availability	None

https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Expand comment: AB added a comment - 06/Jan/2022 1:26 AM, Edited by AB - 10/Feb/2022 12:47 AM

AB added a comment - 06/Jan/2022 1:26 AM - edited This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 4.3 => Medium severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction None Scope Metric Scope Unchanged Impact Metrics Confidentiality Low Integrity None Availability None https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AB made changes - 06/Jan/2022 1:21 AM

Description

Original: Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with administrator privileges to view import source configuration information via a Broken Access Control vulnerability in {component}. ((Use the `; versions` script here to list the fixed and affected versions))

New: Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with administrator privileges to view import source configuration information via a Broken Access Control vulnerability in the Insight Import Source feature. The affected versions are before version 4.21.0. *Affected versions:*  * version < 4.21.0 *Fixed versions:*  * 4.21.0

AB made changes - 06/Jan/2022 1:21 AM

Summary

Original: Import source config information is leaked via the Insight Import Source feature

New: Import source configuration information is leaked via the Insight Import Source feature

Load more older events