JIRA Server Transmits Cleartext Credentials

[Abhijit Kirdat]

Hi, We have recently implemented JIRA Service desk and want to publish over internet for onsite teams. But during VAPT we come to know about below vulnerability and want to close before publishing JIRA over internet. Please help to close the same .

We have already configured SSL certificate for JIRA.

"Web Server Transmits Cleartext Credentials"

[Nic Brough -Adaptavist-]

Not sure what Virginia Association for Pupil Transportation has to do with this, but you'll need to explain more than just a random warning from whatever you're doing.

It looks like a security problem, but I'd suggest you need to explain how it was found and what the methodology was.

[Abhijit Kirdat]

We did nessus vulnerability scanning where we come to know about this vulnerability where JIRA web server is transmit credentials in cleartext from browser to webserver it should not be in cleartext. Please help in getting this address asap.

[Nic Brough -Adaptavist-]

What does the documentation say the vulnerability is?  And where in Jira does it happen?