• Type: Public Security Vulnerability
• Resolution: Fixed
• Priority: Low
• Fix Version/s: 4.21.0, 4.20.2
• Affects Version/s: 4.20.0
• Component/s: None
• Labels:

  • advisory
  • advisory-to-release
  • dont-import
  • security

[JSDSERVER-10983] Import source configuration information is leaked via the Insight Import Source feature - CVE-2021-43950

Sam Xu made changes - 25/Feb/2022 12:12 AM

Fix Version/s

New: 4.20.2 [ 98290 ]

Security Metrics Bot made changes - 20/Feb/2022 8:28 PM

CVE ID

New: CVE-2021-43950

AB made changes - 15/Feb/2022 3:08 AM

Resolution		New: Fixed [ 1 ]
Security	Original: Atlassian Staff [ 10750 ]
Status	Original: Draft [ 12872 ]	New: Published [ 12873 ]

AB made changes - 15/Feb/2022 3:08 AM

Summary

Original: Import source configuration information is leaked via the Insight Import Source feature - CVE registration for this issue is already in progress

New: Import source configuration information is leaked via the Insight Import Source feature - CVE-2021-43950

AB made changes - 10/Feb/2022 12:48 AM

Summary

Original: Import source configuration information is leaked via the Insight Import Source feature

New: Import source configuration information is leaked via the Insight Import Source feature - CVE registration for this issue is already in progress

AB made changes - 10/Feb/2022 12:47 AM

Description

Original: Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with administrator privileges to view import source configuration information via a Broken Access Control vulnerability in the Insight Import Source feature. The affected versions are before version 4.21.0. *Affected versions:*  * version < 4.21.0 *Fixed versions:*  * 4.21.0

New: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source configuration information via a Broken Access Control vulnerability in the Insight Import Source feature. The affected versions are before version 4.21.0. *Affected versions:*  * version < 4.21.0 *Fixed versions:*  * 4.21.0

AB made changes - 06/Jan/2022 1:21 AM

Description

Original: Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with administrator privileges to view import source configuration information via a Broken Access Control vulnerability in {component}. ((Use the `; versions` script here to list the fixed and affected versions))

New: Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with administrator privileges to view import source configuration information via a Broken Access Control vulnerability in the Insight Import Source feature. The affected versions are before version 4.21.0. *Affected versions:*  * version < 4.21.0 *Fixed versions:*  * 4.21.0

AB made changes - 06/Jan/2022 1:21 AM

Summary

Original: Import source config information is leaked via the Insight Import Source feature

New: Import source configuration information is leaked via the Insight Import Source feature

AB made changes - 06/Jan/2022 1:21 AM

Description

Original: This vulnerability affects certain versions of Atlassian Jira Service Management Server. Please describe the impact of the vulnerability here. No known vulnerability could be read off of the parent.

New: Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with administrator privileges to view import source configuration information via a Broken Access Control vulnerability in {component}. ((Use the `; versions` script here to list the fixed and affected versions))

AB made changes - 06/Jan/2022 1:20 AM

Summary

Original: REST API endpoint leaked import source config info by [insight import source]

New: Import source config information is leaked via the Insight Import Source feature

Load more older history items