---
title: "Security Advisory - July, 2021"
canonical: "https://docs.getxporter.app/space/XPORTER/1410731/Security%20Advisory%20-%20July%2C%202021"
format: markdown
---
> ⚠️ We recommend the update of Xporter for Jira Server & Data Center to the 6.7.5 - latest version.

**Xporter for Jira Server and Data Center - SQL Injection on Process Manager and Audit Log**

| **Summary** | <span style="color: #172b4d">SQL Injection on the Process Manager and Audit Log</span> |
| --- | --- |
| **Advisory Release Date** | 7/21/2021   10:00 AM CET |
| **Product** | Xporter for Jira Server & Data Center |
| **Affected on Xporter for Jira Server & Jira Data Center Versions** | - 6.7.1 and earlier |
| **Fixed on Xporter Jira Server & Jira Data Center Versions** | - 6.7.2 and later |

### **Summary of Vulnerability**

This advisory discloses security vulnerabilities classified as **critical **that were present in Xporter for Jira Server & Data Center.

Versions of Jira Server & Data Center affected by this vulnerability:

- 6.7.1 and earlier (fixed in 6.7.2 and later).

**Customers who have upgraded Xporter for Jira Server & Data Center to version 6.7.2 or higher ****are** **<span style="color: #000000">not affected</span>****.**

**Customers who are on any of the affected versions, upgrade your Xporter for Jira Server & Data Center installations immediately to fix this vulnerability.**


#### **Severity**

We rate the severity level of these vulnerabilities as **critical**, according to the scale published in [Bugcrowd’s Vulnerability Rating Taxonomy](https://bugcrowd.com/vulnerability-rating-taxonomy). The scale allows us to rank the severity as critical, high, moderate, or low.

This is our assessment and you should evaluate its applicability to your own IT environment.


#### **Description**

<span style="color: #172b4d">We detected SQL Injection vulnerabilities on the Audit Log and Process Manager features.</span>

These issues can be tracked here: 

> Macro (jira)



> Macro (jira)



> Macro (jira)



### **Fix**

We have released Xporter for Jira Server & DC version 6.7.2 which is available for upgrade through the Atlassian Marketplace.




# **Xporter for Jira Server and Data Center - Local File Disclosure on Templates Management**

| **Summary** | <span style="color: #172b4d">Local File Disclosure on Templates Management</span> |
| --- | --- |
| **Advisory Release Date** | 7/12/2021   10:00 AM CET |
| **Product** | Xporter for Jira Server & Data Center |
| **Affected on Xporter for Jira Server & Jira Data Center Versions** | - 6.7.1 and earlier |
| **Fixed on Xporter Jira Server & Jira Data Center Versions** | - 6.7.2 and later |

### **Summary of Vulnerability**

This advisory discloses a security vulnerability classified as **critical **that was present in Xporter for Jira Server & Data Center.** **Versions of Jira Server & Data Center affected by this vulnerability:

- 6.7.1 and earlier (fixed in 6.7.2 and later).

**Customers who have upgraded Xporter for Jira Server & Data Center to version 6.7.2 or higher ****are** **<span style="color: #000000">not affected</span>****.**

**Customers who are on any of the affected versions, upgrade your Xporter for Jira Server & Data Center installations immediately to fix this vulnerability.**


#### **Severity**

We rate the severity level of this vulnerability as **critical**, according to the scale published in [Bugcrowd’s Vulnerability Rating Taxonomy](https://bugcrowd.com/vulnerability-rating-taxonomy). The scale allows us to rank the severity as critical, high, moderate, or low.

This is our assessment and you should evaluate its applicability to your own IT environment.


#### **Description**

<span style="color: #172b4d">We detected a Local File Disclosure vulnerability on the Templates management.</span>

This issue can be tracked here:  

> Macro (jira)



### **Fix**

We have released Xporter for Jira Server & DC version 6.7.2 which is available for upgrade through the Atlassian Marketplace.



# **Xporter for Jira Server and Data Center - Remote Code Execution on Export/Import Settings and Templates export**

| **Summary** | <span style="color: #172b4d">Remote Code Execution on Export/Import Settings and Templates export</span> |
| --- | --- |
| **Advisory Release Date** | 7/12/2021   10:00 AM CET |
| **Product** | Xporter for Jira Server & Data Center |
| **Affected on Xporter for Jira Server & Jira Data Center Versions** | Export/Import Settings:<br>- 6.7.1 and earlier<br>Templates Export:<br>- 6.7.2 and earlier |
| **Fixed on Xporter Jira Server & Jira Data Center Versions** | Export/Import Settings:<br>- 6.7.2 and later<br>Templates Export:<br>- 6.7.3 and later |

### **Summary of Vulnerability**

This advisory discloses security vulnerabilities classified as **critical **that were present in Xporter for Jira Server & Data Center.** **Versions of Jira Server & Data Center affected by this vulnerability:

- Export/Import Settings: 6.7.1 and earlier (fixed in 6.7.2 and later).
- Templates Export: 6.7.2 and earlier (fixed in 6.7.3 and later).

**Customers who have upgraded Xporter for Jira Server & Data Center to version 6.7.3 or higher ****are** **<span style="color: #000000">not affected</span>****.**

**Customers who are on any of the affected versions, upgrade your Xporter for Jira Server & Data Center installations immediately to fix this vulnerability.**

#### **Severity**

We rate the severity level of these vulnerabilities as **critical**, according to the scale published in [Bugcrowd’s Vulnerability Rating Taxonomy](https://bugcrowd.com/vulnerability-rating-taxonomy). The scale allows us to rank the severity as critical, high, moderate, or low.

This is our assessment and you should evaluate its applicability to your own IT environment.


#### **Description**

<span style="color: #172b4d">We detected Remote Code Execution vulnerabilities on the Export and Import Settings and Template Exports.</span>

These issues can be tracked here:  

> Macro (jira)



> Macro (jira)



### **Fix**

We have released Xporter for Jira Server & DC version 6.7.3 which is available for upgrade through the Atlassian Marketplace.



## **What You Need to Do**

### **Upgrade**

You can upgrade to the latest version of Xporter for Jira Server & Data Center using the Universal Plugin Manager as explained [in Updating apps](https://confluence.atlassian.com/upm/updating-apps-273875710.html). 

### **Support**

If you have questions or concerns regarding this advisory, please raise a support request [here](https://jira.xpand-it.com/servicedesk/customer/portal/2).