IDOR Leads to unauthorized user perform operations on templates, audit log and settings

Xporter Server is vulnerable to Broken Access Control -> Insecure Direct Object References by performing unauthorized operations on administration services.

Steps to reproduce:

• Create one template on jira administration
• Create a user without jira administration permissions
• List the templates by making a GET http request to http://localhost:8080/rest/jiraxporter/1.0/templates
• Delete a template by making a DELETE http request to http://localhost:8080/rest/jiraxporter/1.0/templates/ {id}

Targets:

• Templates
• Settings Get http request http://localhost:8080/jira/rest/jiraxporter/1.0/settings
• Audit logs Get http request 

Remediation steps: Implement a middleware to verify user permissions (JiraAdminRequired annotation).

This issue should also be checked as a Jira Service Desk User.