PT-2016-3907 · Atlassian · Jira+2

Paulo Miguel · Published 2016-01-08 · Updated 2022-03-28 · CVE-2015-8481

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Atlassian JIRA Software version 7.0.3 Atlassian JIRA Core version 7.0.3 Atlassian JIRA Service Desk version 3.0.3

Description The issue allows remote attackers to potentially obtain sensitive information by updating a different issue that includes wiki markup for an external image reference, when a user views an issue with inline wiki markup referencing an image attachment. This occurs because the wrong image is attached to e-mail notifications.

Recommendations For Atlassian JIRA Software version 7.0.3, update to a version that fixes the issue of attaching the wrong image to e-mail notifications. For Atlassian JIRA Core version 7.0.3, update to a version that fixes the issue of attaching the wrong image to e-mail notifications. For Atlassian JIRA Service Desk version 3.0.3, update to a version that fixes the issue of attaching the wrong image to e-mail notifications.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-8481

Affected Products

Jira Core

Jira Service Desk Server

Jira

References · 4

• https://jira.atlassian.com/browse/JRA-47557 · Vendor Advisory
• https://confluence.atlassian.com/jira/jira-security-advisory-2015-12-09-792307790.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8481 · Security Note
• http://securityfocus.com/bid/79381 · Note