Description

Atlassian JIRA is a tool that is used for bug tracking, issue tracking, and project management.

This instance of Atlassian JIRA is misconfigured to allow an attacker to sign up (create a new account) just by navigating to the signup page that is accessible at the URL /servicedesk/customer/user/signup. After the attacker has created a new account it's possible for him/her to access the support portal.

Remediation

Please consult the Atlassian documentation (from the References link) that explains how to choose the right settings to secure your Atlassian JIRA installation.

References

Hundreds of internal servicedesks exposed due to COVID-19

Customer permissions for your service desk and Jira site

Related Vulnerabilities

Drupal Core 9.3.x Security Bypass (9.3.0 - 9.3.5)

Joomla! Core Security Bypass (2.5.0 - 3.9.19)

WordPress Plugin Registration Forms-User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Security Bypass (2.0.13)

WordPress Plugin Metform Elementor Contact Form Builder-Flexible and Design-Friendly Contact Form builder for WordPress Security Bypass (3.2.1)

WordPress Plugin Portable phpMyAdmin Authentication Bypass (1.3.0)

Severity

Medium

Classification

CWE-287 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Authentication Bypass Configuration