Uploaded image for project: 'JIRA Service Desk Server'
  1. JIRA Service Desk Server
  2. JSDSERVER-6590

Authorization bypass allows information disclosure - CVE-2019-15003

    XMLWordPrintable

    Details

      Description

      Authorization bypass allows information disclosure - CVE-2019-15003

      Severity

      Atlassian rates the severity level of this vulnerability as critical, according to the scale published in our Atlassian severity levels. The scale allows us to rank the severity as critical, high, moderate or low.

      This is our assessment and you should evaluate its applicability to your own IT environment.

      Description

      By design, Jira Service Desk gives customer portal users permissions only to raise requests and view issues. This allows users to interact with the customer portal without having direct access to Jira. These restrictions can be bypassed by a remote attacker with portal access who exploits authorization bypass. Note that attackers can grant themselves access to Jira Service Desk portals that have the "Anyone can email the service desk or raise a request in the portal" setting enabled. Exploitation allows an attacker to view all issues within all Jira projects contained in the vulnerable instance. This could include Jira Service Desk projects, Jira Core projects, and Jira Software projects.

      Which versions are affected?

      All versions of Jira Service Desk before 3.9.17, from 3.10.0 before 3.16.9, from 4.0.0 to 4.0.3, from 4.1.0 to 4.1.3, from 4.2.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 are affected by this vulnerability.

      Mitigation

      Refer to the Jira KB for more information on these workarounds.

      *For more information, see the full advisory at https://confluence.atlassian.com/jira/jira-service-desk-security-advisory-2019-11-06-979412717.html

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              Unassigned
              Reporter:
              security-metrics-bot SecurityB
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: