Atlassian Jira Service Management Server/Data Center up to 4.13.19/4.20.7/4.22.1 JSM Insight server-side request forgery

Summaryinfo

A vulnerability has been found in Atlassian Jira Service Management Server and Data Center up to 4.13.19/4.20.7/4.22.1 and classified as critical. This impacts an unknown function of the component JSM Insight. Performing a manipulation results in server-side request forgery. This vulnerability is known as CVE-2021-43959. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, was found in Atlassian Jira Service Management Server and Data Center up to 4.13.19/4.20.7/4.22.1 (Bug Tracking Software). This affects an unknown part of the component JSM Insight. The manipulation with an unknown input leads to a server-side request forgery vulnerability. CWE is classifying the issue as CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network resources via a Server-Side Request Forgery (SSRF) vulnerability in the CSV importing feature of JSM Insight. When running in an environment like Amazon EC2, this flaw may be used to access to a metadata resource that provides access credentials and other potentially confidential information. The affected versions are before version 4.13.20, from version 4.14.0 before 4.20.8, and from version 4.21.0 before 4.22.2.

The weakness was published 07/26/2022. The advisory is shared at jira.atlassian.com. This vulnerability is uniquely identified as CVE-2021-43959 since 11/16/2021. Neither technical details nor an exploit are publicly available.

Upgrading to version 4.13.20, 4.20.8 or 4.22.2 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Bug Tracking Software

Vendor

• Atlassian

Name

• Data Center
• Jira Service Management Server

Version

• 4.13.0
• 4.13.1
• 4.13.2
• 4.13.3
• 4.13.4
• 4.13.5
• 4.13.6
• 4.13.7
• 4.13.8
• 4.13.9
• 4.13.10
• 4.13.11
• 4.13.12
• 4.13.13
• 4.13.14
• 4.13.15
• 4.13.16
• 4.13.17
• 4.13.18
• 4.13.19
• 4.20.0
• 4.20.1
• 4.20.2
• 4.20.3
• 4.20.4
• 4.20.5
• 4.20.6
• 4.20.7
• 4.22.0
• 4.22.1

License

• free

Website

• Vendor: https://www.atlassian.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion