CVE-2019-15003
Description
The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 allows remote attackers with portal access to view arbitrary issues in Jira Service Desk projects via authorization bypass. Note that when the 'Anyone can email the service desk or raise a request in the portal' setting is enabled, an attacker can grant themselves portal access, allowing them to exploit the vulnerability.
How to fix
- atlassian jira_service_desk3.9.17, 3.16.10, 4.2.6, 4.3.5, 4.4.3, 4.5.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian jira_service_desk | v < 3.9.17, 3.10.0 ≤ v < 3.16.10, 4.0.0 ≤ v < 4.2.6, 4.3.0 ≤ v < 4.3.5, 4.4.0 ≤ v < 4.4.3, 4.5.0 ≤ v < 4.5.1 | 3.9.17, 3.16.10, 4.2.6, 4.3.5, 4.4.3, 4.5.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.