Uploaded image for project: 'Jira Cloud'
  1. Jira Cloud
  2. JSWCLOUD-5676 GH Webwork actions are vulnerable to XSRF.
  3. JSWCLOUD-5778

Add XSRF protection to ConfigurationAction and subclasses (Global and Project) for all page pop methods

XMLWordPrintable

    • Icon: Sub-task Sub-task
    • Resolution: Fixed
    • Icon: Low Low
    • 6.0.4
    • None
    • None

        Form Name

          [JSWCLOUD-5778] Add XSRF protection to ConfigurationAction and subclasses (Global and Project) for all page pop methods

          Peter Obara added a comment -

          GlobalConfigurationActions still vulnerable - missing RequiresXSRFCheck annotation

          Peter Obara added a comment - GlobalConfigurationActions still vulnerable - missing RequiresXSRFCheck annotation

          jhinch (Atlassian) added a comment -

          The following URLs should now be protected:

          Project Configuration

          SetDefaultLayout.jspa
          ApplyLayoutToAll.jspa
          SetCorner.jspa
          DefaultCardColor.jspa
          ResetStepDefinition.jspa

          Global Configuration

          GHSetDefaultLayout.jspa
          GHApplyLayoutToAll.jspa
          GHSetCorner.jspa
          GHDefaultCardColor.jspa
          GHResetStepDefinition.jspa

          jhinch (Atlassian) added a comment - The following URLs should now be protected: Project Configuration SetDefaultLayout.jspa ApplyLayoutToAll.jspa SetCorner.jspa DefaultCardColor.jspa ResetStepDefinition.jspa Global Configuration GHSetDefaultLayout.jspa GHApplyLayoutToAll.jspa GHSetCorner.jspa GHDefaultCardColor.jspa GHResetStepDefinition.jspa

          David Black added a comment -

          CVSS score: 5 => Medium severity
           
          Exploitability Metrics

          AccessVector Network
          AccessComplexity Low
          Authentication None

           
          Impact Metrics

          ConfImpact None
          IntegImpact Partial
          AvailImpact None

          See https://extranet.atlassian.com/display/SECCOUNCIL/How+to+evaluate+vulnerability+severity+under+CVSS for details and http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2 for score calculator.

          David Black added a comment - CVSS score: 5 => Medium severity   Exploitability Metrics AccessVector Network AccessComplexity Low Authentication None   Impact Metrics ConfImpact None IntegImpact Partial AvailImpact None See https://extranet.atlassian.com/display/SECCOUNCIL/How+to+evaluate+vulnerability+severity+under+CVSS for details and http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2 for score calculator.

            Unassigned Unassigned
            jhinch jhinch (Atlassian)
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: