wordpress blog stats
Connect with us

Hi, what are you looking for?

Vulnerability in NASA’s Jira setting exposed details of a thousand users

Sensitive information such as internal user details, project details, employee names and mail IDs, was exposed through Jira, a web app that companies use for tracking tasks and issues, at the National Aeronautics and Space Administration aka NASA. NCR based security researcher Avinash Jain, who shared the findings with MediaNama, found the vulnerability and reported it to NASA and the US Cert team on 3 September 2018. Jain said that the details of a thousand users were disclosed due to the vulnerability, which was quietly fixed three weeks after it was reported, on 25 September 2018. However, the period for which the vulnerability existed (before Jain found it) is unclear. [caption id="attachment_195365" align="aligncenter" width="250"] Avinash Jain, Cybersecurity researcher who reported the bug[/caption] Explaining the issue, Jain said that there was an authorisation related misconfiguration in NASA's Jira, which led to the disclosure of information. "In Jira, creating filters or dashboards provides some visibility option to set on them. The issue was due to the wrong permission assigned to them," said Jain. He further explained: "When the filters or dashboards set the visibility to 'All users' and 'everyone' respectively," instead of sharing the information with everyone from the organisation, the filter shares the information with everyone publicly. In a report with his findings, Jain lists various other sections of Jira that had exposed user information and their task related information to other internet users. In his report, Jain said that this can give an attacker an idea about the kind of information housed…

Please subscribe/login to read the full story.
Written By

MediaNama’s mission is to help build a digital ecosystem which is open, fair, global and competitive.

Views

News

Studying the 'community' supporting the late Sushant Singh Rajput (SSR) shows how Twitter was gamed through organized engagement

News

Do we have an enabling system for the National Data Governance Framework Policy (NDGFP) aiming to create a repository of non-personal data?

News

A viewpoint on why the regulation of cryptocurrencies and crypto exchnages under 2019's E-Commerce Rules puts it in a 'grey area'

News

India's IT Rules mandate a GAC to address user 'grievances' , but is re-instatement of content removed by a platform a power it should...

News

There is a need for reconceptualizing personal, non-personal data and the concept of privacy itself for regulators to effectively protect data

You May Also Like

News

Google has released a Google Travel Trends Report which states that branded budget hotel search queries grew 179% year over year (YOY) in India, in...

Advert

135 job openings in over 60 companies are listed at our free Digital and Mobile Job Board: If you’re looking for a job, or...

News

By Aroon Deep and Aditya Chunduru You’re reading it here first: Twitter has complied with government requests to censor 52 tweets that mostly criticised...

News

Rajesh Kumar* doesn’t have many enemies in life. But, Uber, for which he drives a cab everyday, is starting to look like one, he...

MediaNama is the premier source of information and analysis on Technology Policy in India. More about MediaNama, and contact information, here.

© 2008-2021 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ

Subscribe to our daily newsletter
Name:*
Your email address:*
*
Please enter all required fields Click to hide
Correct invalid entries Click to hide

© 2008-2021 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ