{"uuid": "2d818625-ee8d-472c-a696-c146970c2736", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-14847", "type": "seen", "source": "https://gist.github.com/ef-edulog/c410abf6cf7670b099bec3242a3ff996", "content": "\n\n\n\n\nJira Report \u2014 DO / IM / S2\n\n :root {\n --bg: #fff; --bg2: #f5f4ef; --bg3: #ebebeb;\n --tx: #1a1a1a; --tx2: #666660; --tx3: #999994;\n --info: #185FA5; --bdr: rgba(0,0,0,0.12); --bdr2: rgba(0,0,0,0.22);\n --r: 8px; --rl: 12px;\n --font: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n --mono: 'SF Mono','Fira Code',monospace;\n }\n @media(prefers-color-scheme:dark){\n :root{--bg:#1e1e1c;--bg2:#2a2a28;--bg3:#333330;--tx:#f0efe8;--tx2:#a8a79f;--tx3:#6e6e68;--info:#85B7EB;--bdr:rgba(255,255,255,0.1);--bdr2:rgba(255,255,255,0.18)}\n }\n *{box-sizing:border-box;margin:0;padding:0}\n body{font-family:var(--font);background:var(--bg);color:var(--tx);padding:24px;max-width:1300px;margin:0 auto}\n h1{font-size:18px;font-weight:500;margin-bottom:4px}\n .sub{font-size:12px;color:var(--tx2);margin-bottom:20px}\n .tabs{display:flex;gap:6px;margin-bottom:1.25rem;flex-wrap:wrap}\n .tab{padding:5px 13px;border:0.5px solid var(--bdr2);border-radius:var(--r);font-size:13px;cursor:pointer;background:var(--bg);color:var(--tx2)}\n .tab.active{background:var(--bg2);color:var(--tx);font-weight:500}\n .tab:hover:not(.active){background:var(--bg2)}\n .legend{display:flex;gap:14px;flex-wrap:wrap;margin-bottom:1rem;font-size:11px;color:var(--tx2);align-items:center}\n .li{display:flex;align-items:center;gap:4px}\n .ld{width:9px;height:9px;border-radius:2px}\n .summary-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px;margin-bottom:1.25rem}\n .metric{background:var(--bg2);border-radius:var(--r);padding:10px 12px}\n .ml{font-size:11px;color:var(--tx2);margin-bottom:3px}\n .mv{font-size:20px;font-weight:500}\n .project-block{margin-bottom:1.1rem;border:0.5px solid var(--bdr);border-radius:var(--rl);overflow:hidden}\n .ph{padding:9px 14px;border-bottom:0.5px solid var(--bdr);display:flex;align-items:center;justify-content:space-between}\n .pn{font-size:13px;font-weight:500}\n .pm{font-size:11px;color:var(--tx2)}\n .th{padding:5px 14px;font-size:11px;font-weight:500;color:var(--tx2);background:var(--bg2);display:flex;align-items:center;gap:6px;border-top:0.5px solid var(--bdr)}\n .tc{background:var(--bg3);color:var(--tx2);padding:1px 6px;border-radius:var(--r);font-size:10px}\n .cols{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:4px 14px;font-size:10px;color:var(--tx3);background:var(--bg2);border-top:0.5px solid var(--bdr)}\n .ir{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:6px 14px;align-items:start;border-top:0.5px solid var(--bdr);font-size:11px}\n .ir.stale{background:rgba(250,238,218,0.3)}\n .ir.highest{background:rgba(252,235,235,0.35)}\n .ir.overdue{background:rgba(252,235,235,0.45)}\n .ir.stale.highest,.ir.stale.overdue{background:rgba(250,220,200,0.45)}\n @media(prefers-color-scheme:dark){\n .ir.stale{background:rgba(99,56,6,0.2)}.ir.highest{background:rgba(121,31,31,0.2)}\n .ir.overdue{background:rgba(121,31,31,0.3)}.ir.stale.highest,.ir.stale.overdue{background:rgba(110,40,6,0.28)}\n }\n .ik{color:var(--info);font-size:10px;font-family:var(--mono);white-space:nowrap;text-decoration:none}\n .ik:hover{text-decoration:underline}\n .is{color:var(--tx);line-height:1.4;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}\n .ia{color:var(--tx2);font-size:10px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n .dt{font-size:10px;white-space:nowrap}\n .upd-ok{color:var(--tx2)}.upd-stale{color:#BA7517;font-weight:500}\n .due-ok{color:var(--tx2)}.due-over{color:#A32D2D;font-weight:500}\n .cr{color:var(--tx2)}\n @media(prefers-color-scheme:dark){.upd-stale{color:#FAC775}.due-over{color:#F7C1C1}}\n .dot-h{display:inline-block;width:5px;height:5px;border-radius:50%;background:#E24B4A;margin-right:2px;vertical-align:middle}\n .dot-s{display:inline-block;width:5px;height:5px;border-radius:50%;background:#EF9F27;margin-right:2px;vertical-align:middle}\n .dot-d{display:inline-block;width:5px;height:5px;border-radius:50%;background:#D85A30;margin-right:2px;vertical-align:middle}\n .sb{font-size:10px;padding:2px 6px;border-radius:var(--r);text-align:center;white-space:nowrap}\n .s-ip{background:#FAEEDA;color:#854F0B}.s-td{background:#E1F5EE;color:#0F6E56}\n .s-oi{background:#FCEBEB;color:#A32D2D}.s-xx{background:var(--bg2);color:var(--tx2)}\n @media(prefers-color-scheme:dark){\n .s-ip{background:#633806;color:#FAC775}.s-td{background:#085041;color:#9FE1CB}.s-oi{background:#791F1F;color:#F7C1C1}\n }\n .empty{padding:16px;text-align:center;color:var(--tx3);font-size:12px}\n .footer{font-size:11px;color:var(--tx3);margin-top:24px}\n\n\n\n\nJira Active Issues Report \u2014 DO / IM / S2\n\nGenerated June 26, 2026 at 04:43 PM  \u00b7  Excludes Done, Fixed, Canceled, Deferred  \u00b7  https://karrostech.atlassian.net\n\nLast 24 hrs24\u201348 hrs ago2\u20137 days agoOlder than 7 days\n\n\n Highest priority\n Stale \u22655 business days\n Due date missed\n\n\n\n\n\nDO \u2014 Edulog DevOps\n5\n\nIM \u2014 Incident Management\n2\n\nS2 \u2014 Soc-2 & Security\n0\n \n\n \n\n DO \u2014 Edulog DevOps\n 5 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nTask 5\n \n\n DO-2479\n Tangipahoa, LA - Updated ASDI/Talend with New A03 Rule\n \u2014\n Jun 26, '26\n Jun 26, '26\n \u2014\n Backlog\n \n \n\n DO-2478\n Cobb County, GA - Missing Vehicles after Sandbox Replacement\n Mbaoma Mary\n Jun 26, '26\n Jun 26, '26\n \u2014\n Verification\n \n \n\n DO-2476\n Peoria, AZ - Please Adjust Talend for data areas\n Cory Emlen\n Jun 26, '26\n Jun 26, '26\n \u2014\n Backlog\n \n \n\n DO-2473\n AV2 operator SMS \u2014 SNS IAM (PpSmsSnsDelivery), production access, IaC for AthenaV2SecretGetter\n \u2014\n Jun 25, '26\n Jun 25, '26\n \u2014\n Backlog\n \n \n\n DO-2472\n Alexandria, VA - Student Missing from UI\n Eric Fischl\n Jun 25, '26\n Jun 26, '26\n \u2014\n IN PROGRESS\n \n \n\n \n\n IM \u2014 Incident Management\n 2 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nStory 2\n \n\n IM-7672\n San Bernardino, CA - Unable to update the address for a school and checkpoint\n Chukwuemeka Chukwurah\n Jun 26, '26\n Jun 26, '26\n \u2014\n Open Issue\n \n \n\n IM-7671\n PPF - Parents Cant Access Data with Different SAR Codes\n \u2014\n Jun 26, '26\n Jun 26, '26\n \u2014\n Open Issue\n \n\n\n\nDO \u2014 Edulog DevOps\n2\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n9\n \n\n \n\n DO \u2014 Edulog DevOps\n 2 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nTask 2\n \n\n DO-2471\n Rialto, CA - Please Update ASDI\n Cory Emlen\n Jun 25, '26\n Jun 25, '26\n \u2014\n Backlog\n \n \n\n DO-2461\n Peoria, AZ - Please Set up Planned Rollover\n \u2014\n Jun 25, '26\n Jun 26, '26\n \u2014\n Backlog\n \n \n\n \n\n S2 \u2014 Soc-2 & Security\n 9 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nEpic 1\n \n\n S2-680\n [Q2/26] User Access Review\n Madison Irwin\n Jun 25, '26\n Jun 25, '26\n Jul 15, '26\n To Do\n \nTask 8\n \n\n S2-688\n [Q2/26] 1Password\n Bret Marquardt\n Jun 25, '26\n Jun 25, '26\n Jul 15, '26\n To Do\n \n \n\n S2-687\n [Q2/26] GitHub\n Eric Fischl\n Jun 25, '26\n Jun 25, '26\n Jul 15, '26\n To Do\n \n \n\n S2-686\n [Q2/26] Elasticsearch\n Eric Fischl\n Jun 25, '26\n Jun 25, '26\n Jul 15, '26\n To Do\n \n \n\n S2-685\n [Q2/26] Google Workspace\n Eric Fischl\n Jun 25, '26\n Jun 25, '26\n Jul 15, '26\n To Do\n \n \n\n S2-684\n [Q2/26] AWS\n Eric Fischl\n Jun 25, '26\n Jun 25, '26\n Jul 15, '26\n To Do\n \n \n\n S2-683\n [Q2/26] Parent Portal\n Eric Fischl\n Jun 25, '26\n Jun 25, '26\n Jul 15, '26\n To Do\n \n \n\n S2-682\n [Q2/26] Athena Routing Software\n Eric Fischl\n Jun 25, '26\n Jun 25, '26\n Jul 15, '26\n To Do\n \n \n\n S2-681\n [Q2/26] Microsoft 365\n Bret Marquardt\n Jun 25, '26\n Jun 25, '26\n Jul 15, '26\n To Do\n \n\n\n\nDO \u2014 Edulog DevOps\n1\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n \n\n \n\n DO \u2014 Edulog DevOps\n 1 active issue\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nTask 1\n \n\n DO-2446\n Kansas City, KS - Athena/Parent Portal Integration\n \u2014\n Jun 24, '26\n Jun 25, '26\n Jul 1, '26\n Backlog\n \n\n\n\nDO \u2014 Edulog DevOps\n32\n\nIM \u2014 Incident Management\n18\n\nS2 \u2014 Soc-2 & Security\n0\n \n\n \n\n DO \u2014 Edulog DevOps\n 32 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nATH New site request 3\n \n\n DO-2229\n Hillsborough, FL - Athena Conversion from Legacy\n JD Hawk\n Jun 9, '26\n Jun 26, '26\n Jun 26, '26\n IN PROGRESS\n \n \n\n DO-2197\n Newport News, VA - Athena Deployment\n JD Hawk\n Jun 4, '26\n Jun 26, '26\n Jun 25, '26\n IN PROGRESS\n \n \n\n DO-1787\n Elyria, OH - Athena Conversion from Legacy\n Cory Emlen\n Mar 17, '26\n Apr 30, '26 (41d)\n Apr 17, '26\n Blocked\n \nBug 4\n \n\n DO-1855\n There is no data available in Route assignment, Live substitution modules of Telematcis for Johnston site\n Mide Dickson\n Mar 26, '26\n Mar 26, '26 (66d)\n \u2014\n To Do\n \n \n\n DO-1854\n There is no data available in multiple pages like Students, Runs, Routes modules of Routing for Johnston site \n Mide Dickson\n Mar 26, '26\n Mar 26, '26 (66d)\n \u2014\n To Do\n \n \n\n DO-1786\n [EastAllen, IN 1.78 Smoke]CA Result CSV \u2013 Export fails for valid dates with 400 Bad Request (invalid page number)\n Dane Elwood\n Mar 17, '26\n Mar 26, '26 (66d)\n \u2014\n Blocked\n \n \n\n DO-1512\n 500 Internal Server Err on Search API [UAT01/1.78]\n Vader\n Feb 27, '26\n May 29, '26 (20d)\n \u2014\n To Do\n \nStory 4\n \n\n DO-2380\n Aldine, TX - Please run Talend script\n Amy Madzelonka\n Jun 18, '26\n Jun 24, '26\n \u2014\n Verification\n \n \n\n DO-2235\n San Bernardino, CA - SY2627 Data Area - delete stops \n Nathan Bible\n Jun 9, '26\n Jun 12, '26 (10d)\n \u2014\n Backlog\n \n \n\n DO-2025\n Birdville, TX - Please deploy Telematics\n Cory Emlen\n Apr 29, '26\n May 7, '26 (36d)\n \u2014\n Verification\n \n \n\n DO-1112\n Lake Superior, MN Clone - Map Work Package\n David Goldberg\n Nov 20, '25\n Mar 9, '26 (79d)\n \u2014\n IN PROGRESS\n \nTask 21\n \n\n DO-2395\n New Berlin, WI - Please Set Up ASDI\n Cory Emlen\n Jun 19, '26\n Jun 24, '26\n \u2014\n On hold\n \n \n\n DO-2364\n Shared School Services - Set up GTS integration\n Kehinde Metibemu\n Jun 16, '26\n Jun 22, '26\n Jun 18, '26\n Backlog\n \n \n\n DO-2351\n Superior, WI - Please Deploy Web Query\n JD Holwick\n Jun 12, '26\n Jun 15, '26 (9d)\n \u2014\n Backlog\n \n \n\n DO-2262\n Cobb County, GA - Set Up ASDI in fall Sandbox\n Cory Emlen\n Jun 11, '26\n Jun 22, '26\n \u2014\n On hold\n \n \n\n DO-2245\n Newport News, VA - Athena SSO\n Vader\n Jun 10, '26\n Jun 10, '26 (12d)\n \u2014\n IN PROGRESS\n \n \n\n DO-2218\n Johnston, NC - Clone - Stop Checking\n Dan McGuire\n Jun 8, '26\n Jun 10, '26 (12d)\n \u2014\n Backlog\n \n \n\n DO-2165\n Wichita, KS - Update ASDI/Talend to Protect School Code only for 065\n Cory Emlen\n Jun 1, '26\n Jun 22, '26\n \u2014\n Verification\n \n \n\n DO-2101\n Add workforce.edulog.com hosts to Keycloak `driver-portal` client Web Origins + Valid Redirect URIs (3 realms)\n Brandon Donnelson\n May 18, '26\n May 18, '26 (29d)\n \u2014\n IN PROGRESS\n \n \n\n DO-2099\n Add 6 Namecheap CNAMEs for workforce.edulog.com (DP V2 web SPA) + update 3 CloudFront distros with alias + ACM cert\n Brandon Donnelson\n May 18, '26\n May 18, '26 (29d)\n \u2014\n IN PROGRESS\n \n \n\n DO-2055\n Montour-PA - Set up additional ASDI for sandbox 2627sy\n Cory Emlen\n May 7, '26\n Jun 15, '26 (9d)\n \u2014\n Verification\n \n \n\n DO-2006\n Remove non-active Tenants from Grafana Plan Ingestion Global Audit\n JD Hawk\n Aug 25, '25\n Jun 22, '26\n \u2014\n To Do\n \n \n\n DO-1810\n Brevard-FL - Update Tenant Reports \"Bulletin Bus Run\" \n Manuel Esquivel\n Mar 20, '26\n Jun 24, '26\n \u2014\n Backlog\n \n \n\n DO-1748\n San Bernardino, CA - Scan History is showing the wrong time\n Brandon Donnelson\n Mar 11, '26\n Jun 24, '26\n \u2014\n IN PROGRESS\n \n \n\n DO-1425\n Delete AWS Client VPN\n Josiah Brown\n Feb 4, '26\n Feb 18, '26 (92d)\n \u2014\n Backlog\n \n \n\n DO-1158\n Patch CVE-2025-14847 for Mongo Services running 8.0.4\n Vader\n Dec 24, '25\n May 6, '26 (37d)\n \u2014\n On hold\n \n \n\n DO-1125\n Update Crush SG/NACL to not allow internet traffic and restrict to the AWS VPN\n Josiah Brown\n Dec 3, '25\n Feb 18, '26 (92d)\n \u2014\n Backlog\n \n \n\n DO-1077\n Legacy AWS Client Uninstall - Full Cancelation\n Vader\n Nov 13, '25\n Feb 5, '26 (101d)\n \u2014\n On hold\n \n \n\n DO-1049\n Vulnerability - LOW: X-Content-Type-Options Header Missing\n Josiah Brown\n Oct 22, '25\n Mar 3, '26 (83d)\n \u2014\n Backlog\n \n \n\n DO-1048\n Vulnerability - MODERATE: missing anti-clickjacking header\n Josiah Brown\n Oct 22, '25\n Feb 18, '26 (92d)\n \u2014\n Backlog\n \n \n\n DO-1013\n Move all athena-legacy EC2 Instances to have Encrypted EBS Volumes\n Josiah Brown\n Oct 29, '25\n Feb 18, '26 (92d)\n \u2014\n Backlog\n \n \n\n DO-677\n need to implement a lifecycle policy for s3 buckets backups\n \u2014\n May 9, '25\n Feb 18, '26 (92d)\n \u2014\n Backlog\n \n \n\n \n\n IM \u2014 Incident Management\n 18 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nStory 18\n \n\n IM-7654\n Telematics is broken for multiple clients\n Mide Dickson\n Jun 12, '26\n Jun 12, '26 (10d)\n \u2014\n WORK IN PROGRESS\n \n \n\n IM-7646\n Summer School Trips not Available\n Brandon Donnelson\n Jun 10, '26\n Jun 24, '26\n \u2014\n Ready for UAT\n \n \n\n IM-7635\n Katy, TX - Bell Time Tasks are taking an hour to save\n Mide Dickson\n Jun 3, '26\n Jun 4, '26 (16d)\n \u2014\n WORK IN PROGRESS\n \n \n\n IM-7634\n East Allen, IN - SY2627 data area has incorrect student information\n Mide Dickson\n Jun 3, '26\n Jun 11, '26 (11d)\n \u2014\n WORK IN PROGRESS\n \n \n\n IM-7623\n PPF - Ride Registration Address Option not working- SM \n Boluwatife Olaifa\n May 28, '26\n Jun 23, '26\n \u2014\n WORK IN PROGRESS\n \n \n\n IM-7548\n Cobb County, GA - Severely Degraded Athena Performance\n Brandon Donnelson\n Apr 29, '26\n Jun 5, '26 (15d)\n \u2014\n Open Issue\n \n \n\n IM-7547\n Rochambeau, MD - Busses 203/204 have not had movement in Parent Porta Lite since 7:30 PM on 4/27\n Vader\n Apr 29, '26\n Jun 23, '26\n \u2014\n Open Issue\n \n \n\n IM-7544\n Cobb, Ga - bulk set all employee passwords to 9999\n Vader\n Apr 28, '26\n Jun 23, '26\n \u2014\n Open Issue\n \n \n\n IM-7514\n San Bernardino, CA - Telematics > On time performance reports show no data \n Vader\n Apr 10, '26\n Jun 23, '26\n \u2014\n Open Issue\n \n \n\n IM-7430\n Duval HR, FL - Unable to make UDFs in eDTA\n Vader\n Mar 12, '26\n Jun 19, '26 (5d)\n \u2014\n WORK IN PROGRESS\n \n \n\n IM-7263\n ROMEO MI - Vehicle Assignments Missing\n Derek Graham\n Dec 15, '25\n Dec 29, '25 (129d)\n \u2014\n Ready for UAT\n \n \n\n IM-6566\n Duncanville, TX - Boundaries Need to Be Restored or Reimported Based on a Backup\n \u2014\n Mar 25, '25\n May 27, '26 (22d)\n \u2014\n Wait for Release\n \n \n\n IM-6318\n Miss vehicle event in Chicago IL Telematic Non Prod\n Hieu Bui\n Dec 16, '24\n Dec 17, '24 (398d)\n \u2014\n Ready for UAT\n \n \n\n IM-6196\n Portsmouth -PPF - Erroneous Notifications\n Derek Graham\n Oct 24, '24\n Jan 2, '25 (386d)\n \u2014\n Ready for UAT\n \n \n\n IM-6119\n PPF Cant Save Notification Zone\n Derek Graham\n Sep 19, '24\n Nov 28, '24 (411d)\n \u2014\n Ready for UAT\n \n \n\n IM-6043\n West Shore - School Start Message Doesnt work for Athena Routing / Android\n Derek Graham\n Aug 26, '24\n Oct 16, '24 (442d)\n \u2014\n Ready for UAT\n \n \n\n IM-5946\n SQL SAR School Data Not Updated After Athena Upgrade\n Linh Phan\n Jul 30, '24\n Aug 30, '24 (475d)\n \u2014\n Ready for UAT\n \n \n\n IM-5774\n Driver Portal - Tomcat version\n \u2014\n May 21, '24\n Jun 3, '26 (17d)\n \u2014\n Wait for Release\n \n\nData sourced live from Jira on June 26, 2026 at 04:43 PM.\n\nfunction showTab(key,el){\n document.querySelectorAll('.tab').forEach(t=>t.classList.remove('active'));\n el.classList.add('active');\n document.querySelectorAll('.pane').forEach(p=>p.style.display='none');\n document.getElementById('pane-'+key).style.display='block';\n}\n\n\n", "creation_timestamp": "2026-06-26T22:44:42.431741Z"}