PT-2018-6679 · Atlassian · Jira

Published 2018-04-10 · Updated 2022-04-22 · CVE-2017-18101

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Atlassian JIRA Server versions prior to 7.6.5 Atlassian JIRA Server versions 7.7.0 through 7.7.2 Atlassian JIRA Server versions 7.8.0 through 7.8.2 Atlassian JIRA Server version 7.9.0

Description: The issue is related to missing permission checks in various administrative external system import resources. This allows remote attackers to run import operations and determine if an internal service exists.

Recommendations: For versions prior to 7.6.5, update to version 7.6.5 or later. For versions 7.7.0 through 7.7.2, update to version 7.7.3 or later. For versions 7.8.0 through 7.8.2, update to version 7.8.3 or later. For version 7.9.0, update to a version later than 7.9.0.

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

CVE-2017-18101

Affected Products

Jira

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-18101 · Security Note
• https://osv.dev/vulnerability/CVE-2017-18101 · Vendor Advisory
• https://jira.atlassian.com/browse/JRASERVER-67107 · Vendor Advisory
• http://securityfocus.com/bid/103730 · Note