CVE-2019-15003 : Security Advisory and Response
Discover the security vulnerability in Atlassian Jira Service Desk Server and Data Center versions before 3.9.17, from 3.10.0 to 3.16.10, from 4.0.0 to 4.2.6, from 4.3.0 to 4.3.5, from 4.4.0 to 4.4.3, and from 4.5.0 to 4.5.1 allowing unauthorized access to issues.
A vulnerability has been found in multiple versions of Atlassian Jira Service Desk Server and Jira Service Desk Data Center, allowing remote attackers to view unauthorized issues within projects.
Understanding CVE-2019-15003
What is CVE-2019-15003?
The vulnerability in Atlassian Jira Service Desk Server and Jira Service Desk Data Center versions before 3.9.17, from 3.10.0 to 3.16.10, from 4.0.0 to 4.2.6, from 4.3.0 to 4.3.5, from 4.4.0 to 4.4.3, and from 4.5.0 to 4.5.1 allows remote attackers with portal access to view unauthorized issues within Jira Service Desk projects by bypassing authentication.
The Impact of CVE-2019-15003
This vulnerability enables attackers to view unauthorized issues within Jira Service Desk projects, compromising the confidentiality and integrity of sensitive information.
Technical Details of CVE-2019-15003
Vulnerability Description
The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center versions before 3.9.17, from 3.10.0 to 3.16.10, from 4.0.0 to 4.2.6, from 4.3.0 to 4.3.5, from 4.4.0 to 4.4.3, and from 4.5.0 to 4.5.1 allows remote attackers with portal access to view arbitrary issues in Jira Service Desk projects via authorization bypass.
Affected Systems and Versions
- Atlassian Jira Service Desk Server versions before 3.9.17, from 3.10.0 to 3.16.10, from 4.0.0 to 4.2.6, from 4.3.0 to 4.3.5, from 4.4.0 to 4.4.3, and from 4.5.0 to 4.5.1
- Atlassian Jira Service Desk Data Center versions before 3.9.17, from 3.10.0 to 3.16.10, from 4.0.0 to 4.2.6, from 4.3.0 to 4.3.5, from 4.4.0 to 4.4.3, and from 4.5.0 to 4.5.1
Exploitation Mechanism
- Attackers with portal access can view unauthorized issues in Jira Service Desk projects by exploiting an authorization bypass vulnerability.
Mitigation and Prevention
Immediate Steps to Take
- Disable the setting 'Anyone can email the service desk or raise a request in the portal' if not necessary
- Apply the latest security patches provided by Atlassian
Long-Term Security Practices
- Regularly monitor and audit access to Jira Service Desk projects
- Educate users on secure portal access practices
Patching and Updates
- Ensure all affected systems are updated with the latest patches from Atlassian