Jira Connector - Security Risk with Bi-Directional and Manual Push workflow options
When a bi-directional or manual push workflow is created in the Jira Connector the connector does not respect Jira licensing or permissions. The connector only verifies the user creating the workflow and, when run against a smartsheet, the smartsheetownerhas Jira access.
This creates a very large security risk and a corrupted audit trail. With this connector, smartsheet userswithout a Jira license能够更新和修改Jira蜱虫ets and data.
Example 1:
I create a smartsheet and set up a bi-directional workflow connector. Along with my smartsheet access, I have a Jira licenses and permissions within the project the smartsheet is referencing.
I then grant edit access to my smartsheet to Jane. Jane has access to my smartsheetbut does not have a Jira license and does not have any permissions within Jira.
Jane updates the data in the smartsheet.
The connector updates all changes made by Jane against the Jira tickets,despite the fact thatJane does not have a Jira license or any permissions within Jira
Example 2:
I create a smartsheet and set up a bi-directional workflow connector. Along with my smartsheet access, I have a Jira licenses and permissions within the project the smartsheet is referencing.
I then grant edit access to my smartsheet to John. John has access to smartsheet. John has a Jira license but, John does not have any permissions within Jira project the smartsheet is referencing.
John updates the data in the smartsheet.
The connector updates all changes made by John in the Jira tickets,despite the fact thatJohn does not have any permissions within the Jira project to update tickets.
This also leads to a corrupt audit trail as allupdates via the Jira Connector come into Jira under the user name of the person who owns the smartsheet andnot the actual editor of the data.
There are two ways to mitigate this issue:
- Smartsheet updates the Jira Connector to verify the usereditingthe smartsheet has Jira access and Jira project permissions
- Smartsheet updates the Jira Connector to allow admins todisablethe Bi-Directional and Manual Push workflow options.
