Unauthenticated Access to JIRA Dashboards

Category: [Info Disclosure]

module name: check_unauthenticated_dashboard_access

url: rest/api/2/dashboard?maxResults=100

[CG] you'll have to manually/programmatically review these for interesting info

+ Unauthenticated Access to JIRA Dashboards Detected
  URL: https://JIRASERVER/jira/rest/api/2/dashboard?maxResults=100
  Start At: 0
  Max Results: 100
  Total Dashboards: 15

  Dashboard Details:
    - ID: 11200
      Name: ABC
      API URL: https://jiraserver/jira/rest/api/2/dashboard/11200
      View URL: https://jiraserver/jira/secure/Dashboard.jspa?selectPageId=11200
    - ID: 11600
      Name: DEFFHI 
      API URL: https://jirserver/jira/rest/api/2/dashboard/11600
      View URL: https://jiraserver/jira/secure/Dashboard.jspa?selectPageId=11600
    - ID: 10000
      Name: System Dashboard
      API URL: https://jiraserver/jira/rest/api/2/dashboard/10000
      View URL: https://jiraserver/jira/secure/Dashboard.jspa?selectPageId=10000

Example follow up

curl -k -v 'https://jiraserver/jira/rest/api/2/dashboard/11200'

{"id":"11200","name":"ABC","self":"https://jiraserver/jira/rest/api/2/dashboard/11200","view":"https://jiraserver/jira/secure/Dashboard.jspa?selectPageId=11200"}% 

[CG] Every JIRA will have SYSTEM DASHBOARD

+ Unauthenticated Access to JIRA Dashboards Detected
  URL: http://jiraserver/rest/api/2/dashboard?maxResults=100
  Start At: 0
  Max Results: 100
  Total Dashboards: 1

  Dashboard Details:
    - ID: 10000
      Name: System Dashboard
      API URL: http://jiraserver/rest/api/2/dashboard/10000
      View URL: http://jiraserver/secure/Dashboard.jspa?selectPageId=10000