Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Jira Information Gathering

netspi.com | blog | #web-security | #information-disclosure | #jira | #recon | #misconfiguration | #atlassian

Summary

Details Jira misconfigurations that leak usernames, emails, and popular filters to anonymous users, and walks admins through fixing Global Permissions like Browse Users.
Published
Collected

original ↗

Related coverage

vulnerability · samcurry.net
Analysis of CVE-2019-14994 - Jira Service Desk Path Traversal leads to Massive Information Disclosure
CVE-2019-14994: a path traversal in Jira Service Desk lets customer-portal users reach the admin portal and read issues across all Jira projects; walks through affected versions and steps.
blog · netspi.com
Anonymously Enumerating Azure File Resources
Karl Fosaaen explores anonymous enumeration of Azure blob storage, explaining container access policies and releasing tooling to find publicly exposed blobs holding configs, backups, and credentials.
blog · netspi.com
Dumping Git Data from Misconfigured Web Servers
Web servers exposing their .git directory hand attackers the full repository history: the article covers finding exposed repos, mirroring them with wget, and recovering source and config data.
research · bugcrowd.com
Why We’re Letting 60,000 Bugcrowd Security Researchers Ethically Hack Us
Atlassian launches its first public bug bounty on Bugcrowd, adding JIRA and Confluence Cloud to existing Trello and StatusPage programs, with Bugcrowd triaging submissions across 14+ product lines.
vulnerability · hackerone.com
HackerOne and JIRA integration update: more improvements, fewer clicks
HackerOne's JIRA integration gets three updates: the connector is now live on the Atlassian Marketplace, JIRA issues can be created in one click from a report, and two-way syncing is customizable per workflow.
vulnerability · blog.viettelcybersecurity.com
CVE-2022-0540 - Authentication bypass in Seraph
The author dissects CVE-2022-0540, the Jira auth bypass in Atlassian Seraph: role resolution derives from the request URI, and one semicolon defeats the mapping, exposing privileged actions.
back