• Type: Public Security Vulnerability
• Resolution: Fixed
• Priority: Low
• Fix Version/s: 4.20.6
• Affects Version/s: 4.20.4, 4.20.5
• Component/s: None
• Labels:

  • advisory
  • advisory-released
  • dont-import
  • security
  • 🔢✅

[JSDSERVER-11120] Leaked admin credentials via Insight object import

Mandeep Jadon made changes - 21/Feb/2023 3:41 PM

Remote Link

New: This issue links to "Page (Confluence)" [ 733366 ]

Manisha Sangwan made changes - 04/Oct/2022 6:25 AM

Resolution		New: Fixed [ 1 ]
Security	Original: Atlassian Staff [ 10750 ]
Status	Original: Draft [ 12872 ]	New: Published [ 12873 ]

Manisha Sangwan made changes - 04/Oct/2022 6:25 AM

Labels

Original: advisory advisory-to-release dont-import security 🔢✅

New: advisory advisory-released dont-import security 🔢✅

AB made changes - 04/Oct/2022 5:56 AM

Summary

Original: Leaked Admin USER/PASS credentials at [Insight] for JSON data source

New: Leaked admin credentials via Insight object import

AB made changes - 04/Oct/2022 5:56 AM

Affects Version/s

New: 4.20.5 [ 99307 ]

AB made changes - 04/Oct/2022 5:55 AM

Description

Original: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated users to see admin credentials via an information disclosure in the in the \{BaseUrl}/rest/insight/1.0/import/module/test/rlabs-import-type-json?objectSchemaId=<ID> endpoint. The affected versions are before version 4.20.6. *Affected versions:*  * version < 4.20.6 *Fixed versions:*  * 4.20.6

New: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated users to see admin credentials via an information disclosure vulnerability in the \{BaseUrl}/rest/insight/1.0/import/module/test/rlabs-import-type-json?objectSchemaId=<ID> endpoint. The affected versions are before version 4.20.6. *Affected versions:*  * version < 4.20.6 *Fixed versions:*  * 4.20.6

AB made changes - 29/Sep/2022 6:25 AM

Description

Original: Affected versions of Atlassian Jira Service Management Server and Data Center allow low privilege employees to see admin credentials via an information disclosure in the in the \{BaseUrl}/rest/insight/1.0/import/module/test/rlabs-import-type-json?objectSchemaId=<ID> endpoint. The affected versions are before version 4.20.6. *Affected versions:*  * version < 4.20.6 *Fixed versions:*  * 4.20.6

New: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated users to see admin credentials via an information disclosure in the in the \{BaseUrl}/rest/insight/1.0/import/module/test/rlabs-import-type-json?objectSchemaId=<ID> endpoint. The affected versions are before version 4.20.6. *Affected versions:*  * version < 4.20.6 *Fixed versions:*  * 4.20.6

Manisha Sangwan made changes - 29/Sep/2022 6:09 AM

Description

Original: Affected versions of Atlassian Jira Service Management Server and Data Center allows other low privilege employees to see admin credentials via information leakage in the API \{BaseUrl}/rest/insight/1.0/import/module/test/rlabs-import-type-json?objectSchemaId=<ID> response. The affected versions are before version 4.20.6. *Affected versions:*  * version < 4.20.6 *Fixed versions:*  * 4.20.6

New: Affected versions of Atlassian Jira Service Management Server and Data Center allow low privilege employees to see admin credentials via an information disclosure in the in the \{BaseUrl}/rest/insight/1.0/import/module/test/rlabs-import-type-json?objectSchemaId=<ID> endpoint. The affected versions are before version 4.20.6. *Affected versions:*  * version < 4.20.6 *Fixed versions:*  * 4.20.6

AB made changes - 29/Sep/2022 2:40 AM

Description

Original: Affected versions of Atlassian Jira Service Management Server and Data Center allows other low privilege employees to see admin credentials via information leakage in the API \{BaseUrl}/rest/insight/1.0/import/module/test/rlabs-import-type-json?objectSchemaId=<ID> response. The affected versions of Atlassian Jira Service Management Server and Data Center are before version 4.20.4. *Affected versions:*  * 4.20.4 *Fixed versions:*  * 4.20.6

New: Affected versions of Atlassian Jira Service Management Server and Data Center allows other low privilege employees to see admin credentials via information leakage in the API \{BaseUrl}/rest/insight/1.0/import/module/test/rlabs-import-type-json?objectSchemaId=<ID> response. The affected versions are before version 4.20.6. *Affected versions:*  * version < 4.20.6 *Fixed versions:*  * 4.20.6

Manisha Sangwan made changes - 28/Sep/2022 12:01 PM

Description

Original: Affected versions of Atlassian Jira Service Management Server leaks  remote attackers to view sensitive information via an Information Disclosure vulnerability in {component} The affected versions of Atlassian Jira Service Management Server and Data Center are before version 4.20.4. *Affected versions:*  * 4.20.4 *Fixed versions:*  * 4.20.6

New: Affected versions of Atlassian Jira Service Management Server and Data Center allows other low privilege employees to see admin credentials via information leakage in the API \{BaseUrl}/rest/insight/1.0/import/module/test/rlabs-import-type-json?objectSchemaId=<ID> response. The affected versions of Atlassian Jira Service Management Server and Data Center are before version 4.20.4. *Affected versions:*  * 4.20.4 *Fixed versions:*  * 4.20.6

Load more older events