PT-2016-3907 · Atlassian · Jira+2

Paulo Miguel · Publicado 2016-01-08 · Atualizado 2022-03-28 · CVE-2015-8481

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Atlassian JIRA Software version 7.0.3 Atlassian JIRA Core version 7.0.3 Atlassian JIRA Service Desk version 3.0.3

Description The issue allows remote attackers to potentially obtain sensitive information by updating a different issue that includes wiki markup for an external image reference, when a user views an issue with inline wiki markup referencing an image attachment. This occurs because the wrong image is attached to e-mail notifications.

Recommendations For Atlassian JIRA Software version 7.0.3, update to a version that fixes the issue of attaching the wrong image to e-mail notifications. For Atlassian JIRA Core version 7.0.3, update to a version that fixes the issue of attaching the wrong image to e-mail notifications. For Atlassian JIRA Service Desk version 3.0.3, update to a version that fixes the issue of attaching the wrong image to e-mail notifications.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-8481

Produtos afetados

Jira Core

Jira Service Desk Server

Jira

Referências · 4

• https://jira.atlassian.com/browse/JRA-47557 · Aviso do Fabricante
• https://confluence.atlassian.com/jira/jira-security-advisory-2015-12-09-792307790.html · Aviso do Fabricante
• http://securityfocus.com/bid/79381 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-8481 · Nota de Segurança