nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Rovo Security related findings

Anandhi Arumugam _Cprime_

Hi all,

While adopting Rovo, has any of your Cybersec teams conducted Penetration testing? Have they identified any issues like Prompt Injection or Sensitive Information Disclosure?

We have seen these identified in one of our very secure Cloud Enterprise org and I'd like to find what solution was applied to overcome this. Any help appreciated.

Accepted answers

Nikola Perisic

Hi @Anandhi Arumugam _Cprime_

Atlassian has its own place for reporting the vulnerabilities upon the penetration testing. You would need to report this vulnerability, they need to verify it and upon that, they would apply a fix.

You can report that in here: https://www.atlassian.com/trust/security/report-a-vulnerability

They also have a bug bounty program that is hosted by Bugcrowd where the report could also be reported.

OffensiveSecurity has a good article on this: https://www.offsec.com/blog/how-to-prevent-prompt-injection/

All comments

Nikola Perisic

Hi @Anandhi Arumugam _Cprime_

Atlassian has its own place for reporting the vulnerabilities upon the penetration testing. You would need to report this vulnerability, they need to verify it and upon that, they would apply a fix.

You can report that in here: https://www.atlassian.com/trust/security/report-a-vulnerability

They also have a bug bounty program that is hosted by Bugcrowd where the report could also be reported.

OffensiveSecurity has a good article on this: https://www.offsec.com/blog/how-to-prevent-prompt-injection/

Anandhi Arumugam _Cprime_

Thank you @Nikola Perisic This has been reported to Atlassian and they are involved with the Security team in understanding further details. We have investigated the permissions and the system is quite restricted in itself. So must be something else causing in the underlying LLM layer.

Dr Valeri Colon (Connect Centric)

@Anandhi Arumugam _Cprime_ One distinction may help your investigation: prompt injection or sensitive-data disclosure doesn’t necessarily point to the underlying LLM. Rovo retrieves authorized organizational data and can use tools/actions around the model, so findings can occur in retrieval, context handling, tool execution, output handling, or permissions enforcement. I’d document the exact attack path with your security team and Atlassian—it will help identify which control actually failed.

Anandhi Arumugam _Cprime_

Thanks @Dr Valeri Colon _Connect Centric_ We are working with Atlassian on this investigation.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

enterprise

jira-service-management-cloud

jira-service-management

rovo-atlassian-intelligence

atlassian

rovo