URL Path Traversal in Jira Service Desk Server and Jira Service Desk Data Center

Question

The issue:

https://jira.atlassian.com/browse/JSDSERVER-6517

My current product version:

JIRA v7.8.0

JIRA Agile v7.8.0-DAILY20180212023044

I don't have installed Jira Service Desk Server and Jira Service Desk Data Center.

Should I worry about this vulnerability issue? Is it affecting my products?

Alexis Robert · Accepted Answer

Hi @Irnik Iv ,

you are not affected by this security issue, but since your instance version is 7.8.0 you're still vulnerable to many securiy issues : https://confluence.atlassian.com/jira/security-advisories-112853939.html

You should upgrade as soon as possible to Jira 7.13.8.

Let me know if this helps,

--Alexis

Boris MBOUMEHANG · Accepted Answer

Hi,

First of all, welcome to that Atlassian Community. It is good to have you here.

As mentionned in the CVE details, this vulnerability only affects Jira Service Desk (Server and Data Center), even if users who set the "Browse Project" permission for their Jira Software or Jira Core projects to "Group - Anyone". 
So, you do not have to worry.

But, if you still have doubts, you can ask the Atlassian support for confirmation.

I hope this will help.

Thanks
Boris