Exposed JIRA server leaks NASA staff and project data

guest · Jan 11, 2019

Exposed JIRA server leaks NASA staff and project data
January 11, 2019
https://medium.com/@logicbomb_1/bug...user-and-project-details-are-out-2f2e3580421b

[...] an interesting vulnerability that I have found in NASA Jira (An Atlassian task tracking systems/project management software etc.) or more specifically a misconfiguration issue which caused the leakage of internal sensitive information of NASA including their internal user details, project details, employee names, employees mail id etc.

One of the biggest concerns of any company is ensuring that internal information is kept confidential and only available to specific individuals within and outside of an organisation [...]

Additionally, it can give an attacker an idea of what kind of information may be housed within the application and what projects team is working upon along with showing features of different projects.
Click to expand...

guest · Aug 3, 2019

Misconfigured JIRA Servers Leak Info on Users and Projects
August 3, 2019
https://www.bleepingcomputer.com/ne...jira-servers-leak-info-on-users-and-projects/

Organizations like Google, Yahoo, NASA, Lenovo, 1Password, Zendesk, as well as governing bodies across the world left unprotected private details that could have jeopardized their developments.
Some entities continue to unwittingly expose to the public the names, roles, and email addresses of employees involved in various projects of the organization, along with the current stage and development of those activities.
Definitely a visibility problem
This information becomes public when a setting is used for controlling the visibility of filters and dashboards for projects on Jira servers, says Avinash Jain, the security engineer that discovered the problem.

Jain told BleepingComputer that when a new filter and dashboard is created in Jira Cloud, the default visibility setting is "all" and this is understood as 'all within the organization' but it refers to everyone on the internet.

"Thousands of companies filters, dashboards and staff data were publicly exposed," says the researcher.
Click to expand...

One Misconfig (JIRA) to Leak Them All- Including NASA and Hundreds of Fortune 500 Companies!

Log in or Sign up

Exposed JIRA server leaks NASA staff and project data

guest Guest

guest Guest

Log in or Sign up

Exposed JIRA server leaks NASA staff and project data

guest Guest

guest Guest

Useful Searches