PT-2018-8512 · Atlassian · Jira+2

Publicado 2018-01-29 · Atualizado 2019-10-09 · CVE-2017-9513

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Atlassian Activity Streams versions prior to 6.3.0

Description The issue allows remote authenticated attackers to bypass permission checks, enabling them to watch any Confluence page and receive notifications when comments are added. They can also vote and watch JIRA issues they do not have access to, although they will not receive notifications for the issue.

Recommendations For versions prior to 6.3.0, update to version 6.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive Confluence pages and JIRA issues to minimize the risk of exploitation.

Correção

Improper Access Control

Missing Authorization

Enumeração de Fraquezas

CWE-284

CWE-862

Identificadores relacionados

CVE-2017-9513

Produtos afetados

Activity Streams

Confluence

Jira

Referências · 4

• https://ecosystem.atlassian.net/browse/STRM-2350 · Aviso do Fabricante
• http://securityfocus.com/bid/102869 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-9513 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-9513 · Aviso do Fabricante