Recent Security Advisory Regarding Jira Service Management

[David Yu]

I don't see this in the mitigation, but removing disabling Insight is also a valid strategy, right?

[Daniel Eads · Accepted solution]

Hi @David Yu ,

I've moved your question into its own topic to reduce confusion for folks looking at other questions.

Removing the plugin entirely is a strategy that would mitigate the vulnerability, only if you are on a version of Jira Service Management prior to 4.15.0 when the app became bundled with JSM. Do note we are talking about using the Uninstall action in the plugin manager rather than the Disable action. However, versions of Jira Service Management in which you can uninstall Insight also can be mitigated by upgrading to version 8.9.3 of the Insight app.

Can you confirm which version of Jira Service Management you are running?

Thanks,
Daniel Eads | Atlassian Support

[serkan_sezer]

Hi, we are using version 8.20.1. We do not even have a mobile add-on among our add-ons, in this case, do we need to take any precautions? There is quite a bit of confusion when I read the other titles.

thank you