-
Type:
Bug
-
Status:
Closed
-
Priority:
High
-
Resolution:
Bug Fixed
-
Affects Version/s:
None
-
Fix Version/s:
None
-
-
-
-
-
-
-
-
-
Company:
All Clients/Multiple Clients
-
Item State:
LB QA
- In Testing
-
[Security]-[Authorization Failure] Employee can access all Admin pages over the URL and able to update the customization/settings for those pages.
Environment : Azure
Replication Steps:
1. Login as Company Admin
2. GO to Company Information Page.
3. Copy the URL
4. Login with Employee of same company in another browser.
5. Paste the URL in employee's session.
6. Access the Admin pages and try to update settings.
Observed Same behavior on multiple pages like All tabs in Company Information, Manage Admin Users, Security Page, Site Branding and Themes etc.
It seems that this issue is with all pages and necessary access level entries are missing.
Expected Result:
As soon as any admin level page URL is accessed by Employee Login it should show the Unauthorized Access page and restrict user for further actions.
CC : Rakesh RoySachin HingoleHrishikesh DeshpandeVijay SiddhaVijayendra ShindeRohan J KhandaveBharti SatputeSamir
- relates to
-
NF-2714
Vulnerability Assessment and Penetration Testing for Workterra on Azure US environment.
-
-
To Do
{"report":{"apdex":1,"isInitial":true,"journeyId":"6b62d8c7-eaba-4bda-bd86-b3a6e8bc499e","key":"jira.project.issue.view-issue","navigationType":0,"readyForUser":948.1000003814697,"redirectCount":0,"resourceLoadedEnd":927.1000003814697,"resourceLoadedStart":124.60000038146973,"resourceTiming":[{"duration":375.7999997138977,"initiatorType":"link","name":"https://jira.workterra.net/s/3003653444a1e1a85555cab7dcfb3a21-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/css/_super/batch.css","startTime":124.60000038146973,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":124.60000038146973,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":500.40000009536743,"responseStart":0,"secureConnectionStart":0},{"duration":375.59999990463257,"initiatorType":"link","name":"https://jira.workterra.net/s/dd6a0911920485696ac20493290df627-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/css/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&richediton=true","startTime":124.90000009536743,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":124.90000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":500.5,"responseStart":0,"secureConnectionStart":0},{"duration":375.3999996185303,"initiatorType":"link","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.css","startTime":125.10000038146973,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":125.10000038146973,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":500.5,"responseStart":0,"secureConnectionStart":0},{"duration":375.5,"initiatorType":"link","name":"https://jira.workterra.net/s/bd548f27bbf8f278bd83b60dd3284ed8-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static-adgs/jira.webresources:global-static-adgs.css","startTime":125.10000038146973,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":125.10000038146973,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":500.6000003814697,"responseStart":0,"secureConnectionStart":0},{"duration":375.40000009536743,"initiatorType":"link","name":"https://jira.workterra.net/s/70725731a158a7140f19ddbd4201ba27-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static/jira.webresources:global-static.css","startTime":125.30000019073486,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":125.30000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":500.7000002861023,"responseStart":0,"secureConnectionStart":0},{"duration":384.30000019073486,"initiatorType":"script","name":"https://jira.workterra.net/s/f2623af22c15df767ec6ff268ae0b8bd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/js/_super/batch.js?locale=en-US","startTime":125.40000009536743,"connectEnd":125.40000009536743,"connectStart":125.40000009536743,"domainLookupEnd":125.40000009536743,"domainLookupStart":125.40000009536743,"fetchStart":125.40000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":125.40000009536743,"responseEnd":509.7000002861023,"responseStart":509.7000002861023,"secureConnectionStart":125.40000009536743},{"duration":442.7000002861023,"initiatorType":"script","name":"https://jira.workterra.net/s/6ce676f2a5bcc9651cef6e7956f05def-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/js/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":125.5,"connectEnd":125.5,"connectStart":125.5,"domainLookupEnd":125.5,"domainLookupStart":125.5,"fetchStart":125.5,"redirectEnd":0,"redirectStart":0,"requestStart":125.5,"responseEnd":568.2000002861023,"responseStart":568.2000002861023,"secureConnectionStart":125.5},{"duration":445.69999980926514,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/4.1.5/_/download/resources/com.atlassian.plugins.atlassian-chaperone:hotspot-tour/hotspot-tour.js?batch=false&locale=en-US","startTime":125.60000038146973,"connectEnd":125.60000038146973,"connectStart":125.60000038146973,"domainLookupEnd":125.60000038146973,"domainLookupStart":125.60000038146973,"fetchStart":125.60000038146973,"redirectEnd":0,"redirectStart":0,"requestStart":125.60000038146973,"responseEnd":571.3000001907349,"responseStart":571.3000001907349,"secureConnectionStart":125.60000038146973},{"duration":446.19999980926514,"initiatorType":"script","name":"https://jira.workterra.net/s/6aa3fcf1fac5fd551eee0b69077524e6-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/aae1242f5fc81cc6a5bb8bc963ccda29/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en-US","startTime":125.7000002861023,"connectEnd":125.7000002861023,"connectStart":125.7000002861023,"domainLookupEnd":125.7000002861023,"domainLookupStart":125.7000002861023,"fetchStart":125.7000002861023,"redirectEnd":0,"redirectStart":0,"requestStart":125.7000002861023,"responseEnd":571.9000000953674,"responseStart":571.9000000953674,"secureConnectionStart":125.7000002861023},{"duration":446.5,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":125.90000009536743,"connectEnd":125.90000009536743,"connectStart":125.90000009536743,"domainLookupEnd":125.90000009536743,"domainLookupStart":125.90000009536743,"fetchStart":125.90000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":125.90000009536743,"responseEnd":572.4000000953674,"responseStart":572.4000000953674,"secureConnectionStart":125.90000009536743},{"duration":447,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":126,"connectEnd":126,"connectStart":126,"domainLookupEnd":126,"domainLookupStart":126,"fetchStart":126,"redirectEnd":0,"redirectStart":0,"requestStart":126,"responseEnd":573,"responseStart":573,"secureConnectionStart":126},{"duration":447.59999990463257,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.js?locale=en-US","startTime":126.10000038146973,"connectEnd":126.10000038146973,"connectStart":126.10000038146973,"domainLookupEnd":126.10000038146973,"domainLookupStart":126.10000038146973,"fetchStart":126.10000038146973,"redirectEnd":0,"redirectStart":0,"requestStart":126.10000038146973,"responseEnd":573.7000002861023,"responseStart":573.7000002861023,"secureConnectionStart":126.10000038146973},{"duration":448.19999980926514,"initiatorType":"link","name":"https://jira.workterra.net/s/05c862146699bb029ceb0a489075e63b-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/bcd66e9a133a1b9f5fd14b56841e1c5b/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":126.2000002861023,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":126.2000002861023,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":574.4000000953674,"responseStart":0,"secureConnectionStart":0},{"duration":448.09999990463257,"initiatorType":"script","name":"https://jira.workterra.net/rest/api/1.0/shortcuts/805012/ea6f30d2bfdc99578bb23f4a5bac3ecd/shortcuts.js?context=issuenavigation&context=issueaction","startTime":126.30000019073486,"connectEnd":126.30000019073486,"connectStart":126.30000019073486,"domainLookupEnd":126.30000019073486,"domainLookupStart":126.30000019073486,"fetchStart":126.30000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":126.30000019073486,"responseEnd":574.4000000953674,"responseStart":574.4000000953674,"secureConnectionStart":126.30000019073486},{"duration":449.2000002861023,"initiatorType":"link","name":"https://jira.workterra.net/s/9095228fa10daa2d3e3d7d5760c95e91-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.css?jira.create.linked.issue=true&richediton=true","startTime":126.40000009536743,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":126.40000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":575.6000003814697,"responseStart":0,"secureConnectionStart":0},{"duration":448.80000019073486,"initiatorType":"script","name":"https://jira.workterra.net/s/c19a1b46e985d7fb85efaf27c8febfdd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.js?jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":126.5,"connectEnd":126.5,"connectStart":126.5,"domainLookupEnd":126.5,"domainLookupStart":126.5,"fetchStart":126.5,"redirectEnd":0,"redirectStart":0,"requestStart":126.5,"responseEnd":575.3000001907349,"responseStart":575.3000001907349,"secureConnectionStart":126.5},{"duration":564.5999999046326,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":127.80000019073486,"connectEnd":127.80000019073486,"connectStart":127.80000019073486,"domainLookupEnd":127.80000019073486,"domainLookupStart":127.80000019073486,"fetchStart":127.80000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":127.80000019073486,"responseEnd":692.4000000953674,"responseStart":692.4000000953674,"secureConnectionStart":127.80000019073486},{"duration":799.2000002861023,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":127.90000009536743,"connectEnd":127.90000009536743,"connectStart":127.90000009536743,"domainLookupEnd":127.90000009536743,"domainLookupStart":127.90000009536743,"fetchStart":127.90000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":127.90000009536743,"responseEnd":927.1000003814697,"responseStart":927.1000003814697,"secureConnectionStart":127.90000009536743},{"duration":210.19999980926514,"initiatorType":"xmlhttprequest","name":"https://jira.workterra.net/rest/webResources/1.0/resources","startTime":716.2000002861023,"connectEnd":716.2000002861023,"connectStart":716.2000002861023,"domainLookupEnd":716.2000002861023,"domainLookupStart":716.2000002861023,"fetchStart":716.2000002861023,"redirectEnd":0,"redirectStart":0,"requestStart":716.2000002861023,"responseEnd":926.4000000953674,"responseStart":926.4000000953674,"secureConnectionStart":716.2000002861023}],"threshold":1000,"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":26,"responseStart":118,"responseEnd":119,"domLoading":121,"domInteractive":1019,"domContentLoadedEventStart":1019,"domContentLoadedEventEnd":1079,"domComplete":1423,"loadEventStart":1423,"loadEventEnd":1427,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[],"measures":[],"correlationId":"d67f9eff9cb2e6","effectiveType":"4g","downlink":9.6,"rtt":0,"serverDuration":63,"dbReadsTimeInMs":4,"dbConnsTimeInMs":4,"applicationHash":"156decd7d2b4272533aa6cefc8294af635e1da97","experiments":[]}}
Hi Ashwin Wankhede,
Done.
Ashwin Wankhede