Critical Security vulnerability - Password are not encripted and display in URL

Claude Cuttaia

I was really badly surprise to see my password display in the URL when i click on Bitbucket from JIRA or Confluence.

https://bitbucket.org/my-atlassian-passord-in-clear/workspace/overview

 

that means my password is not encripted,  can be found by a lot of people, is very vulnerable due to this bug and Atlassian expose it without taking the minimum of security mesure. 

Can you share if you have the same vulnerability ?

Oliver Siebenmarck {Polymetis Apps}

Hi @Claude Cuttaia ,

Welcome to the community!

That is indeed very peculiar. Usually that part of the URL should be the name of the workspace you are in or your username, it should never be your actual password (unless they are identical). 

So, if you can confirm that your password is being leaked here, I would suggest contacting Atlassian directly, you can report a vulnerability here: https://www.atlassian.com/trust/security/report-a-vulnerability

Best regards,
 Oliver