Reporting Phishing in Jira

[Charles Pereira]

This is not a question, it’s a report. Jira’s JSM software currently contains links that point to phishing sites. I’m using this channel to report the issue because Jira does not appear to provide a public channel for reporting phishing within its software. The only option available is for organization administrators, which doesn’t make sense that only organization admins can report this. Most people who use Jira are operations staff, not admins, so they should also have a way to report phishing or security issues directly.

[Trudy Claspill]

I have raised a support ticket about this. I'll report back Atlassian's response.

[Charles Pereira]

Thanks, Trudy.

[Trudy Claspill]

Atlassian team say:

Our security team has shared that they're aware and remediation is in progress

[Marc - Devoteam]

Hi @Charles Pereira 

Any type of admin can raise an issue at Atlassian Support

Except a space/project admin, the user needs to be Jira admin or higher, or if you are using a free subscription

And how did this issue get in your instance, who made this issue?

Is it done via an email integration, a user made this issue or else?

[Trudy Claspill]

@Marc - Devoteam 

The information is not coming through an issue.

In Jira in Software projects there is a tab labeled </> Code where there is a tile (apparently created by Atlassian, since I see it in other environments) for Azure DevOps Development. The author is pointing out that when you hover over the text in that tile (not over one of the links in the tile) then the tile appears to be a link to the URL https://www.azuredevopslabs.com. (I have validated this to be true in other Jira Cloud environments.)

In the second image the author is indicating that if you actually go to that link then you don't end up on a Microsoft Azure DevOps Lab site, but rather some other site entirely.

I found the same site shown by the author when I navigated to the specified URL.

[Charles Pereira]

Yes, exactly this! It's a link to a phishing site that should be removed immediately. 

[PJ Zaiac]

Hi all! I've just gotten a confirmation that our security team is working on a remediation for this - typically they aren't able to follow up on Community directly, but if I see an update that it's resolved I'll come back here to share 🙏🏻