PT-2018-6682 · Atlassian · Jira

Yuki Okamoto · Publicado 2018-07-24 · Atualizado 2022-03-25 · CVE-2017-18104

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Atlassian Jira versions prior to 7.6.7 Atlassian Jira versions 7.7.0 through 7.10.x

Description: The issue allows remote attackers who can observe or intercept webhook events to learn information about changes in issues that should not be sent because they are not contained within the results of a specified JQL query.

Recommendations: For versions prior to 7.6.7, update to version 7.6.7 or later. For versions 7.7.0 through 7.10.x, update to version 7.11.0 or later. As a temporary workaround, consider restricting access to webhook events to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-18104

Produtos afetados

Jira

Referências · 3

• 🔥 https://jira.atlassian.com/browse/JRASERVER-59980 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-18104 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-18104 · Aviso do Fabricante