CVE-2017-9505

Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments added to a page after they started watching it even if they do not have permission to view the page itself.

CVSS v3 4.3 MEDIUM
CVSS v2.0 4.0 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/99086	Third Party Advisory VDB Entry
https://jira.atlassian.com/browse/CONFSERVER-52560	Mitigation Vendor Advisory
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170613-0_Atlassian_Confluence_Access_Restriction_Bypass_v10.txt	Exploit Mitigation Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:atlassian:confluence:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-06-15 16:29

Updated : 2024-02-28 16:04

NVD link : CVE-2017-9505

Mitre link : CVE-2017-9505

CVE.ORG link : CVE-2017-9505

JSON object : View

Products Affected

atlassian

confluence

CWE

CWE-276

Incorrect Default Permissions

{"id": "CVE-2017-9505", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2017-06-15T16:29:00.233", "references": [{"url": "http://www.securityfocus.com/bid/99086", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@atlassian.com"}, {"url": "https://jira.atlassian.com/browse/CONFSERVER-52560", "tags": ["Mitigation", "Vendor Advisory"], "source": "security@atlassian.com"}, {"url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170613-0_Atlassian_Confluence_Access_Restriction_Bypass_v10.txt", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "security@atlassian.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments added to a page after they started watching it even if they do not have permission to view the page itself."}, {"lang": "es", "value": "Atlassian Confluence desde la versi\u00f3n 4.3.0 hasta la 6.2.1 no comprobaba si un usuario ten\u00eda permiso para visualizar una p\u00e1gina mientras se creaba una notificaci\u00f3n workbox sobre nuevos comentarios. Un atacante que pueda iniciar sesi\u00f3n en Confluence podr\u00eda recibir notificaciones workbox, que contienen los comentarios, para los comentarios a\u00f1adidos a una p\u00e1gina una vez que han empezado a verla aunque no tengan permiso para visualizar la propia p\u00e1gina."}], "lastModified": "2020-07-21T16:50:16.893", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:confluence:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9806EAE9-4652-46DF-866A-B580435705E4", "versionEndExcluding": "6.2.1", "versionStartIncluding": "4.3"}], "operator": "OR"}]}], "sourceIdentifier": "security@atlassian.com"}