The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.1
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.9.17, 3.16.10, 4.2.6, 4.3.5, 4.4.3, and 1 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 allows remote attackers with portal access to view arbitrary issues in Jira Service Desk projects via authorization bypass. Note that when the 'Anyone can email the service desk or raise a request in the portal' setting is enabled, an attacker can grant themselves portal access, allowing them to exploit the vulnerability.
Timeline
- CVE published
- Record last updated
Affected versions
- Atlassian Jira Service Desk Server
fixed in 3.9.17; From 3.10.0; fixed in 3.16.10; From 4.0.0; fixed in 4.2.6; From 4.3.0; fixed in 4.3.5; From 4.4.0; fixed in 4.4.3; From 4.5.0; fixed in 4.5.1
- Atlassian Jira Service Desk Data Center
fixed in 3.9.17; From 3.10.0; fixed in 3.16.10; From 4.0.0; fixed in 4.2.6; From 4.3.0; fixed in 4.3.5; From 4.4.0; fixed in 4.4.3; From 4.5.0; fixed in 4.5.1