nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How to block the /secure/admin/SendBulkMail!default.jspa endpoint in Jira server?

Abhinav Arae

Hello All,

I'm working on mitigating the recent Jira security issue by Blocking the /secure/admin/SendBulkMail!default.jspa endpoint from being accessed in Jira server. I don't find this property in server.xml or in other files.

Could someone please help me here?

Thank you.

Accepted answers

Thomas Deiler_db00h3

Dear @Abhinav Arae ,

you can do this in two different manners:

Option 1:

Read this article and adapt server.xml to your needs.

Option 2:

Block the URL in front of Tomcat - within the reverse proxy configuration. For nginx follow this article.

So long

Thomas

All comments

Thomas Deiler_db00h3

Dear @Abhinav Arae ,

you can do this in two different manners:

Option 1:

Read this article and adapt server.xml to your needs.

Option 2:

Block the URL in front of Tomcat - within the reverse proxy configuration. For nginx follow this article.

So long

Thomas

Anurag Jalan_xyytiu

Hi Abhinav,

I had provided few details regarding this here https://community.atlassian.com/t5/Jira-questions/Which-document-must-be-blocked-for-the-Workaround-for-CVE-2019/qaq-p/1128938?utm_source=atlcomm&utm_medium=email&utm_campaign=mentions_reply&utm_content=topic

You can try to follow the same.

Abhinav Arae

Hello Anurag,

Thank you very much for your reply. I've tried the same and restarted the instance, but I'm still able to hit this page: https://jira.dev.****.com/secure/admin/SendBulkMail!default.jspa

I thought the expected outcome should be, we shouldn't be able to hit this page which mitigates the security issue, Am I correct?

I really appreciate your help!

Thank you.

Abhinav Arae

Hello Thomas,

Thank you very much for your reply. I've tried the same and restarted the instance, but I'm still able to hit this page: https://jira.dev.****.com/secure/admin/SendBulkMail!default.jspa

I thought the expected outcome should be, we shouldn't be able to hit this page which mitigates the security issue, Am I correct?

I really appreciate your help!

Thank you.

Thomas Deiler_db00h3

Dear @Abhinav Arae ,

you commented both answers with the same comment, that it doesn't work. So why is the first answer accepted, when it didn't help? What do I miss?

Thomas

Abhinav Arae

Sorry, I unaccepted it now. Could you please help me fix this? I wonder if I'm adding the context path at the wrong location in server.xml file.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

jira-server