A vulnerable issue for Path Traversal,

Question

Hi All

I have a vulnerable issue for Path Traversal, how can I fix this issue with on-premise environment (v7.6.13)

[JSDSERVER-6589] URL path traversal allows information disclosure - CVE-2019-15004 - Create and track feature requests for Atlassian products.

PS: Hopefully  you can give me any user-guideline, thanks.

Thanks,

Willie

willie_6osymw · Answer

Hi @Kai Becker

I've tried to disable the jira-dnd-attachment-plugin but it still show "Path Traversal" issue, please help me. thanks.

```

bash /opt/jira/bin/start-jira.sh --disable-addons=com.atlassian.jira.plugins.jira-dnd-attachment-plugin

```

willie_6osymw · Answer

Hi @Kai Becker

Sorry to bother you again, I've tried many times with production and staging server but unfortunately, it isn't working for me, please do me a favor, thanks again.

PS: Please check my test recording

Kai Becker · Answer

Hi @willie ,

sorry for the late response. I'm not an sysadmin, so I can't  give you any tips/hints on url rewrite stuff. Sorry about that.

But I would highly recommend, that your Jira should not be accessible outside your company network. Jira 7.6.x reached End of Life on 16 November, 2019, so there might be a lot more vulnerabilities in your current setup.