-
Type:
Bug
-
Status:
Closed
-
Priority:
High
-
Resolution:
Bug Fixed
-
Affects Version/s:
None
-
Fix Version/s:
None
-
-
-
-
-
-
-
-
-
Company:
All Clients/Multiple Clients
-
Item State:
LB QA
- In Testing
-
[Security]-[Authorization Failure] Employee can access all Admin pages over the URL and able to update the customization/settings for those pages.
Environment : Azure
Replication Steps:
1. Login as Company Admin
2. GO to Company Information Page.
3. Copy the URL
4. Login with Employee of same company in another browser.
5. Paste the URL in employee's session.
6. Access the Admin pages and try to update settings.
Observed Same behavior on multiple pages like All tabs in Company Information, Manage Admin Users, Security Page, Site Branding and Themes etc.
It seems that this issue is with all pages and necessary access level entries are missing.
Expected Result:
As soon as any admin level page URL is accessed by Employee Login it should show the Unauthorized Access page and restrict user for further actions.
CC : Rakesh RoySachin HingoleHrishikesh DeshpandeVijay SiddhaVijayendra ShindeRohan J KhandaveBharti SatputeSamir
- relates to
-
NF-2714
Vulnerability Assessment and Penetration Testing for Workterra on Azure US environment.
-
-
To Do
{"report":{"apdex":0.5,"isInitial":true,"journeyId":"9782a45b-4afd-44fa-9dad-d090cf863d18","key":"jira.project.issue.view-issue","navigationType":0,"readyForUser":2460.9000000003725,"redirectCount":0,"resourceLoadedEnd":3099.300000000745,"resourceLoadedStart":846.8000000007451,"resourceTiming":[{"duration":1096.2999999998137,"initiatorType":"link","name":"https://jira.workterra.net/s/3003653444a1e1a85555cab7dcfb3a21-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/css/_super/batch.css","startTime":846.8000000007451,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":846.8000000007451,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1943.1000000005588,"responseStart":0,"secureConnectionStart":0},{"duration":1091.9000000003725,"initiatorType":"link","name":"https://jira.workterra.net/s/dd6a0911920485696ac20493290df627-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/css/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&richediton=true","startTime":851.7000000001863,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":851.7000000001863,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1943.6000000005588,"responseStart":0,"secureConnectionStart":0},{"duration":1092.0999999996275,"initiatorType":"link","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.css","startTime":851.8000000007451,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":851.8000000007451,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1943.9000000003725,"responseStart":0,"secureConnectionStart":0},{"duration":1095.300000000745,"initiatorType":"link","name":"https://jira.workterra.net/s/bd548f27bbf8f278bd83b60dd3284ed8-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static-adgs/jira.webresources:global-static-adgs.css","startTime":852,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":852,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1947.300000000745,"responseStart":0,"secureConnectionStart":0},{"duration":1095.6000000005588,"initiatorType":"link","name":"https://jira.workterra.net/s/70725731a158a7140f19ddbd4201ba27-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static/jira.webresources:global-static.css","startTime":852,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":852,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1947.6000000005588,"responseStart":0,"secureConnectionStart":0},{"duration":1146.8999999994412,"initiatorType":"script","name":"https://jira.workterra.net/s/f2623af22c15df767ec6ff268ae0b8bd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/js/_super/batch.js?locale=en-US","startTime":852.1000000005588,"connectEnd":852.1000000005588,"connectStart":852.1000000005588,"domainLookupEnd":852.1000000005588,"domainLookupStart":852.1000000005588,"fetchStart":852.1000000005588,"redirectEnd":0,"redirectStart":0,"requestStart":852.1000000005588,"responseEnd":1999,"responseStart":1999,"secureConnectionStart":852.1000000005588},{"duration":1222.0999999996275,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/4.1.5/_/download/resources/com.atlassian.plugins.atlassian-chaperone:hotspot-tour/hotspot-tour.js?batch=false&locale=en-US","startTime":852.3000000007451,"connectEnd":852.3000000007451,"connectStart":852.3000000007451,"domainLookupEnd":852.3000000007451,"domainLookupStart":852.3000000007451,"fetchStart":852.3000000007451,"redirectEnd":0,"redirectStart":0,"requestStart":852.3000000007451,"responseEnd":2074.4000000003725,"responseStart":2074.4000000003725,"secureConnectionStart":852.3000000007451},{"duration":1217.5999999996275,"initiatorType":"script","name":"https://jira.workterra.net/s/6ce676f2a5bcc9651cef6e7956f05def-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/js/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":852.3000000007451,"connectEnd":852.3000000007451,"connectStart":852.3000000007451,"domainLookupEnd":852.3000000007451,"domainLookupStart":852.3000000007451,"fetchStart":852.3000000007451,"redirectEnd":0,"redirectStart":0,"requestStart":852.3000000007451,"responseEnd":2069.9000000003725,"responseStart":2069.9000000003725,"secureConnectionStart":852.3000000007451},{"duration":1222.9000000003725,"initiatorType":"script","name":"https://jira.workterra.net/s/6aa3fcf1fac5fd551eee0b69077524e6-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/aae1242f5fc81cc6a5bb8bc963ccda29/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en-US","startTime":852.4000000003725,"connectEnd":852.4000000003725,"connectStart":852.4000000003725,"domainLookupEnd":852.4000000003725,"domainLookupStart":852.4000000003725,"fetchStart":852.4000000003725,"redirectEnd":0,"redirectStart":0,"requestStart":852.4000000003725,"responseEnd":2075.300000000745,"responseStart":2075.300000000745,"secureConnectionStart":852.4000000003725},{"duration":1220.3999999994412,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":855.3000000007451,"connectEnd":855.3000000007451,"connectStart":855.3000000007451,"domainLookupEnd":855.3000000007451,"domainLookupStart":855.3000000007451,"fetchStart":855.3000000007451,"redirectEnd":0,"redirectStart":0,"requestStart":855.3000000007451,"responseEnd":2075.7000000001863,"responseStart":2075.7000000001863,"secureConnectionStart":855.3000000007451},{"duration":1220.7999999998137,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":855.4000000003725,"connectEnd":855.4000000003725,"connectStart":855.4000000003725,"domainLookupEnd":855.4000000003725,"domainLookupStart":855.4000000003725,"fetchStart":855.4000000003725,"redirectEnd":0,"redirectStart":0,"requestStart":855.4000000003725,"responseEnd":2076.2000000001863,"responseStart":2076.2000000001863,"secureConnectionStart":855.4000000003725},{"duration":1219.699999999255,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.js?locale=en-US","startTime":856.8000000007451,"connectEnd":856.8000000007451,"connectStart":856.8000000007451,"domainLookupEnd":856.8000000007451,"domainLookupStart":856.8000000007451,"fetchStart":856.8000000007451,"redirectEnd":0,"redirectStart":0,"requestStart":856.8000000007451,"responseEnd":2076.5,"responseStart":2076.5,"secureConnectionStart":856.8000000007451},{"duration":1219.5,"initiatorType":"link","name":"https://jira.workterra.net/s/05c862146699bb029ceb0a489075e63b-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/bcd66e9a133a1b9f5fd14b56841e1c5b/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":857.7000000001863,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":857.7000000001863,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":2077.2000000001863,"responseStart":0,"secureConnectionStart":0},{"duration":1218.5,"initiatorType":"script","name":"https://jira.workterra.net/rest/api/1.0/shortcuts/805012/e80c7a6aee0fa86c2b1a716575a614aa/shortcuts.js?context=issuenavigation&context=issueaction","startTime":858.5,"connectEnd":858.5,"connectStart":858.5,"domainLookupEnd":858.5,"domainLookupStart":858.5,"fetchStart":858.5,"redirectEnd":0,"redirectStart":0,"requestStart":858.5,"responseEnd":2077,"responseStart":2077,"secureConnectionStart":858.5},{"duration":1218.5,"initiatorType":"link","name":"https://jira.workterra.net/s/9095228fa10daa2d3e3d7d5760c95e91-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.css?jira.create.linked.issue=true&richediton=true","startTime":859.2000000001863,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":859.2000000001863,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":2077.7000000001863,"responseStart":0,"secureConnectionStart":0},{"duration":1217.7000000001863,"initiatorType":"script","name":"https://jira.workterra.net/s/c19a1b46e985d7fb85efaf27c8febfdd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.js?jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":860.1000000005588,"connectEnd":860.1000000005588,"connectStart":860.1000000005588,"domainLookupEnd":860.1000000005588,"domainLookupStart":860.1000000005588,"fetchStart":860.1000000005588,"redirectEnd":0,"redirectStart":0,"requestStart":860.1000000005588,"responseEnd":2077.800000000745,"responseStart":2077.800000000745,"secureConnectionStart":860.1000000005588}],"threshold":1000,"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":746,"responseStart":842,"responseEnd":843,"domLoading":845,"domInteractive":3193,"domContentLoadedEventStart":3193,"domContentLoadedEventEnd":3281,"domComplete":3550,"loadEventStart":3550,"loadEventEnd":3553,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[],"measures":[],"correlationId":"216f72eb9f86ef","effectiveType":"4g","downlink":10,"rtt":0,"serverDuration":66,"dbReadsTimeInMs":4,"dbConnsTimeInMs":5,"applicationHash":"156decd7d2b4272533aa6cefc8294af635e1da97","experiments":[]}}
Hi Ashwin Wankhede,
Done.
Ashwin Wankhede