PT-2018-6682 · Atlassian · Jira

Yuki Okamoto · Published 2018-07-24 · Updated 2022-03-25 · CVE-2017-18104

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Atlassian Jira versions prior to 7.6.7 Atlassian Jira versions 7.7.0 through 7.10.x

Description: The issue allows remote attackers who can observe or intercept webhook events to learn information about changes in issues that should not be sent because they are not contained within the results of a specified JQL query.

Recommendations: For versions prior to 7.6.7, update to version 7.6.7 or later. For versions 7.7.0 through 7.10.x, update to version 7.11.0 or later. As a temporary workaround, consider restricting access to webhook events to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-18104

Affected Products

Jira

References · 3

• 🔥 https://jira.atlassian.com/browse/JRASERVER-59980 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-18104 · Security Note
• https://osv.dev/vulnerability/CVE-2017-18104 · Vendor Advisory