Atlassian Jira Service Management Data Center and Server 10.3.x < 10.3.25 / 11.3.x < 11.3.1 (JSDSERVER-16838)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(367874);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/20");

  script_cve_id("CVE-2026-84292");

  script_name(english:"Atlassian Jira Service Management Data Center and Server 10.3.x < 10.3.25 / 11.3.x < 11.3.1 (JSDSERVER-16838)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Atlassian Jira Service Management Data Center and Server (Jira Service Desk) host is missing a security
update.");
  script_set_attribute(attribute:"description", value:
"The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host
is affected by a vulnerability as referenced in the JSDSERVER-16838 advisory.

  - fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the
    userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is
    not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and
    pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back
    as the attacker's host with no error, so re-validating the built URI does not catch it. This affects
    applications that build URIs from parts and assign untrusted data to the port component through the
    serialize, normalize, or equal functions in their object forms. The issue affects fast-uri versions before
    2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is fixed in 2.4.6, 3.1.7, and 4.1.4, where
    recomposeAuthority rejects any port that is not a digit sequence per RFC 3986. (CVE-2026-84292)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://jira.atlassian.com/browse/JSDSERVER-16838");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Atlassian Jira Service Management Data Center and Server version 10.3.25, 11.3.1 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-84292");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:atlassian:jira_service_desk");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("jira_service_desk_installed_win.nbin", "jira_service_desk_installed_nix.nbin");
  script_require_keys("installed_sw/JIRA Service Desk Application");

  exit(0);
}

include('vdf.inc');

# @tvdl-content-verify-only
var vuln_data = {
  "metadata": {
    "spec_version": "1.0"
  },
  "checks": [
    {
      "product": {
        "name": "JIRA Service Desk Application",
        "type": "app"
      },
      "check_algorithm": "default",
      "constraints": [
        {
          "min_version": "10.3.0",
          "fixed_version": "10.3.25",
          "fixed_display": "10.3.25 / 11.3.1"
        },
        {
          "min_version": "11.3.0",
          "fixed_version": "11.3.1"
        }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);