Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Web services accessible without authentication

Description

By carefully constructing a HTTP POST request, an attacker can execute any of the portal's web services. This vulnerability allows the attacker to circumvent both the permission system and the protection provided by the SecureFilter's portal properties:

xxx.servlet.hosts.allowed
xxx.servlet.https.required

Activity

Show:

Samuel Kong July 4, 2012 at 2:28 AM

Fixed
Pinned fields
Click on the next to a field label to start pinning.

Details

Assignee

Reporter

Components

Fix versions

Affects versions

Priority

Zendesk Support

Created July 4, 2012 at 2:27 AM
Updated June 24, 2023 at 4:00 PM
Resolved July 4, 2012 at 2:30 AM