漏洞描述
Jira Netic Group Export add-on before 1.0.3 contains a missing authorization vulnerability. The add-on does not perform authorization checks, which can allow an unauthenticated user to export all groups from the Jira instance by making a groupexport_download=true request to a plugins/servlet/groupexportforjira/admin/ URI and thereby potentially obtain sensitive information, modify data, and/or execute unauthorized operations.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
gist.github.comhttps://gist.github.com/CveCt0r/ca8c6e46f536e9ae69fc6061f132463e↗marketplace.atlassian.comhttps://marketplace.atlassian.com/apps/1222388/group-export-for-jira/version-history↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2022-39960↗github.comhttps://github.com/ARPSyndicate/kenzer-templates↗