CVE-2017-9505 Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Conflu...
MediumCVSS 4.3
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments added to a page after they started watching it even if they do not have permission to view the page itself.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian confluence | >= 4.3, < 6.2.1 | 6.2.1 |
| atlassian confluence server | = Versions of Confluence starting with 4.3.0 before 6.2.1 are affected by this vulnerability. | No fix listed |
References
- 99086 third-party-advisory vdb-entry
- jira.atlassian.com mitigation vendor-advisory
- www.sec-consult.com exploit mitigation third-party-advisory