You're on your way to the next level! Join the Kudos program to earn points and save your progress.
Level 1: Seed
25 / 150 points
1 badge earned
Challenges come and go, but your rewards stay with you. Do more to earn more!
What goes around comes around! Share the love by gifting kudos to your peers.
Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!
Join now to unlock these features and more
The Atlassian Community can help you and your team get more value out of Atlassian products and practices.
This is a response to an article published on Medium about a potential security problem many admins fall into, and has been mentioned here on Community before.
I'm almost directly quoting Jamie Echlin's original blog from Adatptavist below:
A few days ago this blog, about poor Jira configurations, circulated on Medium and social media. Although in truth this is not a new issue.
It's easy to misconfigure Jira in a way that accidentally allows that user information to be retrieved by unauthenticated users. Less importantly, saved filter and dashboard names can also be accessed anonymously, which might provide clues about upcoming features, or leak internal information.
In recent releases Atlassian have strived to make it much clearer when you are sharing publicly, rather than just sharing within your internal organisation, but nevertheless Jira instances may already have many public filters and dashboards.
Fixing these is manual and often time-consuming, so we have written a script for ScriptRunner for Jira (Server and Data Center) that will report and fix these by simply replacing the single Public permission with an "Authenticated Users" permission.
Copy it into Script Console (Admin -> Script Console) and hit the Run button. It will list the three possible problem areas - which are:
If you are happy to have it fix all of these change the FIX_MODE = false to true, and re-run.
Some filters may not be able to be fixed if the owner has been deactivated - check for log messages. In these cases you could just delete the filters, or bulk transfer ownership to another user.
If you don't have ScriptRunner for Jira installed, get an evaluation license to run this as a once-off.
Nic Brough -Adaptavist-
Principal Consultant (Senior geek, with mentoring duties)
12,042 accepted answers