• Type: Public Security Vulnerability
• Resolution: Fixed
• Priority: Low
• Fix Version/s: 4.20.6
• Affects Version/s: 4.19.0
• Component/s: None
• Labels:

  • advisory
  • advisory-to-release
  • dont-import
  • security
  • 🔢✅

[JSDSERVER-11128] Source configuration information leakage in API response

Mandeep Jadon made changes - 21/Feb/2023 3:41 PM

Remote Link

New: This issue links to "Page (Confluence)" [ 733451 ]

Manisha Sangwan (Inactive) made changes - 19/Oct/2022 1:29 AM

Resolution		New: Fixed [ 1 ]
Security	Original: Atlassian Staff [ 10750 ]
Status	Original: Draft [ 12872 ]	New: Published [ 12873 ]

Manisha Sangwan (Inactive) made changes - 19/Oct/2022 1:28 AM

Description

Original: Affected versions of Atlassian Jira Service Management Server and Data Center allow an unauthorised user to view source configuration information via information disclosure in the endpoint /rest/insight/1.0/progress/category/imports/. *Affected versions:*  * 4.20.6 *Fixed versions:*  * 4.20.6

New: Affected versions of Atlassian Jira Service Management Server and Data Center allow an unauthorised user to view source configuration information via information disclosure in the endpoint /rest/insight/1.0/progress/category/imports/. *Affected versions:*  * 4.19.0 *Fixed versions:*  * 4.20.6

Manisha Sangwan (Inactive) made changes - 19/Oct/2022 1:28 AM

Affects Version/s	Original: 4.20.6 [ 99596 ]
Affects Version/s		New: 4.19.0 [ 96190 ]

AB made changes - 04/Oct/2022 5:57 AM

Description

Original: Affected versions of Atlassian Jira Service Management Server and Data Center allow an unauthorised user to view source configuration information via information disclosure in the endpoint /rest/insight/1.0/progress/category/imports/1. *Affected versions:*  * 4.20.6 *Fixed versions:*  * 4.20.6

New: Affected versions of Atlassian Jira Service Management Server and Data Center allow an unauthorised user to view source configuration information via information disclosure in the endpoint /rest/insight/1.0/progress/category/imports/. *Affected versions:*  * 4.20.6 *Fixed versions:*  * 4.20.6

AB made changes - 04/Oct/2022 5:54 AM

Summary

Original: Source configuration information leakage in API response.

New: Source configuration information leakage in API response

Manisha Sangwan (Inactive) made changes - 29/Sep/2022 4:53 AM

Description

Original: Affected versions of Atlassian Jira Service Management Server and Data Center allows an unauthorised user to get hold of source configuration information via information leakage in the endpoint /rest/insight/1.0/progress/category/imports/1. *Affected versions:*  * 4.20.6 *Fixed versions:*  * 4.20.6

New: Affected versions of Atlassian Jira Service Management Server and Data Center allow an unauthorised user to view source configuration information via information disclosure in the endpoint /rest/insight/1.0/progress/category/imports/1. *Affected versions:*  * 4.20.6 *Fixed versions:*  * 4.20.6

Manisha Sangwan (Inactive) made changes - 28/Sep/2022 12:26 PM

Summary

Original:  REST API endpoint leaked import source config info by [Synchronize object]

New: Source configuration information leakage in API response.

Manisha Sangwan (Inactive) made changes - 28/Sep/2022 12:25 PM

Description

Original: Affected versions of Atlassian Jira Service Management Server and Data Center allows an unauthorised user to get hold of configuration information via a information leakage in the endpoint /rest/insight/1.0/progress/category/imports/1. *Affected versions:*  * 4.20.6 *Fixed versions:*  * 4.20.6

New: Affected versions of Atlassian Jira Service Management Server and Data Center allows an unauthorised user to get hold of source configuration information via information leakage in the endpoint /rest/insight/1.0/progress/category/imports/1. *Affected versions:*  * 4.20.6 *Fixed versions:*  * 4.20.6

Manisha Sangwan (Inactive) made changes - 28/Sep/2022 12:25 PM

Description

Original: Affected versions of Atlassian Jira Service Management Server and Data Center allows other low privilege employees to see admin credentials via information leakage in the API \{BaseUrl}/rest/insight/1.0/import/module/test/rlabs-import-type-json?objectSchemaId=<ID> response. The affected versions of Atlassian Jira Service Management Server and Data Center are before version 4.20.6. *Affected versions:*  * 4.20.6 *Fixed versions:*  * 4.20.6

New: Affected versions of Atlassian Jira Service Management Server and Data Center allows an unauthorised user to get hold of configuration information via a information leakage in the endpoint /rest/insight/1.0/progress/category/imports/1. *Affected versions:*  * 4.20.6 *Fixed versions:*  * 4.20.6

Load more older history items