Unknown user can login

Andrus Randveer
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
March 12, 2018

By surprise, I was able to login to my past employer's company Confluence and Jira Cloud. I saw myself as an "Unknown user". I could see most of the content. Looks like a security issue.

Unfortunately this discussion forum was the only place I could find to report bugs.

2 comments

Comment

Log in or Sign up to comment
Nic Brough -Adaptavist-
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
March 12, 2018

You should get in touch with their admins and let them know that they have misconfigured their system.

Andrus Randveer
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
March 13, 2018

So it is a valid use-case?

Do you happen to know any documentation about this feature?

At the moment I really cannot imagine a case where it would make any sense for the system to allow such configuration.

Nic Brough -Adaptavist-
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
March 13, 2018

Yes, quite a lot of people allow anonymous access (not logged in) to their systems.  Also, users with little or no access because they've been removed from all groups and roles etc, but not actively disabled or deleted will still get access to anything using "all logged in users", which is a widely used default.

(Although I've only found one real use-case for "anonymous write", which just begs for spam attacks)

C
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
March 19, 2018

I agree with Nic,   you can disable anonymous access in the properties files on the server to prevent individual space admins enabling "allow anonymous".  Sadly, most Confluence instances I look at I have found space admins do not understand "Security" or why opening your space up is bad thing. 

We ultimately created scripts to search for spaces using anonymous and turned off the capability. While we had SSO in front of our Confluence space.  We had issues with JIRA Service Desk Customers being able to access Confluence spaces if anonymous was enabled.  (because they were logged in, (but not actually confluence users).

SD Admin
Contributor
April 3, 2018

Hi all,

I have a question. If I allow anyone can send request without loggin in in Jira Service Desk and at the same time allowing them to access Confluence. How is the permission / security level setup in Confluence? Giving example below,

1. Will Tim (customer) from organization A able to search all organization knowledge base or only organization A knowledge base?

2. Can we limit Tim do not have access to knowledge base but open the knowledge based for agent and control by project or organization?

3. We are payroll service provider, how can the content in Confluence be secure when come to confidential information?

Please advise. Thanks

TAGS
AUG Leaders

Atlassian Community Events