• Type: Public Security Vulnerability
• Resolution: Fixed
• Priority: Low
• Fix Version/s: 4.13.20, 4.20.8, 4.22.2
• Affects Version/s: 4.22.1, 4.13.19, 4.20.7
• Component/s: None
• Labels:

  • advisory
  • advisory-to-release
  • dont-import
  • security
  • 🔢✅

[JSDSERVER-11898] SSRF via CSV import into JSM Insight - CVE-2021-43959

Mandeep Jadon made changes - 21/Feb/2023 3:40 PM

Remote Link

New: This issue links to "Page (Confluence)" [ 733361 ]

Security Metrics Bot made changes - 31/Jul/2022 8:28 PM

CVE ID

New: CVE-2021-43959

AB made changes - 27/Jul/2022 1:00 AM

Security

Original: Atlassian Staff [ 10750 ]

Security Metrics Bot made changes - 26/Jul/2022 1:46 PM

Labels

Original: advisory advisory-to-release dont-import security

New: advisory advisory-to-release dont-import security 🔢✅

AB made changes - 26/Jul/2022 7:59 AM

Resolution		New: Fixed [ 1 ]
Status	Original: Draft [ 12872 ]	New: Published [ 12873 ]

AB made changes - 26/Jul/2022 7:59 AM

Summary

Original: SSRF via CSV import into JSM Insight - CVE registration for this issue is already in progress

New: SSRF via CSV import into JSM Insight - CVE-2021-43959

AB made changes - 26/Jul/2022 2:59 AM

Summary

Original: SSRF via CSV import into JSM Insight

New: SSRF via CSV import into JSM Insight - CVE registration for this issue is already in progress

AB made changes - 26/Jul/2022 2:59 AM

Summary

Original: SSRF via CSV import into JSM Insights

New: SSRF via CSV import into JSM Insight

AB made changes - 26/Jul/2022 2:59 AM

Description

Original: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network resources via a Server-Side Request Forgery (SSRF) vulnerability in the ObjectSchema.jspa endpoint. When running in an environment like Amazon EC2, this flaw may be used to access to a metadata resource that provides access credentials and other potentially confidential information. The affected versions are before version 4.13.20, from version 4.14.0 before 4.20.8, and from version 4.21.0 before 4.22.2. *Affected versions:*  * version < 4.13.20  * 4.14.0 ≤ version < 4.20.8  * 4.21.0 ≤ version < 4.22.2 *Fixed versions:*  * 4.13.20  * 4.20.8  * 4.22.2

New: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network resources via a Server-Side Request Forgery (SSRF) vulnerability in the CSV importing feature of JSM Insight. When running in an environment like Amazon EC2, this flaw may be used to access to a metadata resource that provides access credentials and other potentially confidential information. The affected versions are before version 4.13.20, from version 4.14.0 before 4.20.8, and from version 4.21.0 before 4.22.2. *Affected versions:*  * version < 4.13.20  * 4.14.0 ≤ version < 4.20.8  * 4.21.0 ≤ version < 4.22.2 *Fixed versions:*  * 4.13.20  * 4.20.8  * 4.22.2

AB made changes - 26/Jul/2022 2:58 AM

Summary

Original: An Atlassian product has a security vulnerability.

New: SSRF via CSV import into JSM Insights

Load more older history items