PT-2022-5982 · Amazon+1 · Amazon Ec2+2

Published 2022-06-26 · Updated 2022-08-02 · CVE-2021-43959

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Atlassian Jira Service Management Server and Data Center versions prior to 4.13.20 Atlassian Jira Service Management Server and Data Center versions 4.14.0 through 4.20.8 Atlassian Jira Service Management Server and Data Center versions 4.21.0 through 4.22.2

Description The vulnerability is related to insufficient server-side request checking in the CSV import feature of JSM Insight, allowing a remote attacker to perform a Server-Side Request Forgery (SSRF) attack. This flaw can be used to access internal network resources, including metadata resources that provide access credentials and other potentially confidential information, especially in environments like Amazon EC2.

Recommendations For versions prior to 4.13.20, update to version 4.13.20 or later. For versions 4.14.0 through 4.20.8, update to version 4.20.8 or later. For versions 4.21.0 through 4.22.2, update to version 4.22.2 or later. As a temporary workaround, consider restricting access to the CSV importing feature of JSM Insight until a patch is applied.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2022-07411

CVE-2021-43959

Affected Products

Amazon Ec2

Jsm Insight

Jira Service Management Server

References · 6

• https://bdu.fstec.ru/vul/2022-07411 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-43959 · Security Note
• https://jira.atlassian.com/browse/JSDSERVER-11898 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43959 · Vendor Advisory
• https://vuldb.com/ru/?id.205005 · Note
• https://t.me/cvenotify/33761 · Telegram Post