CVE-2017-9513

Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & receive notifications when comments are added to the watched page, and vote & watch JIRA issues that they do not have access to, although they will not receive notifications for the issue, via missing permission checks.

CVSS v3 5.4 MEDIUM
CVSS v2.0 5.5 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:N

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/102869	Third Party Advisory VDB Entry
https://ecosystem.atlassian.net/browse/STRM-2350	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:atlassian:activity_streams:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-01-29 19:29

Updated : 2019-10-09 23:30

NVD link : CVE-2017-9513

Mitre link : CVE-2017-9513

CVE.ORG link : CVE-2017-9513

JSON object : View

Products Affected

atlassian

activity_streams

CWE

CWE-862

Missing Authorization

CWE-284

Improper Access Control

{"id": "CVE-2017-9513", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2018-01-29T19:29:01.063", "references": [{"url": "http://www.securityfocus.com/bid/102869", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@atlassian.com"}, {"url": "https://ecosystem.atlassian.net/browse/STRM-2350", "tags": ["Vendor Advisory"], "source": "security@atlassian.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}, {"type": "Secondary", "source": "security@atlassian.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & receive notifications when comments are added to the watched page, and vote & watch JIRA issues that they do not have access to, although they will not receive notifications for the issue, via missing permission checks."}, {"lang": "es", "value": "Varios recursos rest de acci\u00f3n inline de Atlassian Activity Streams en versiones anteriores a la 6.3.0 permiten que atacantes remotos autenticados vean cualquier p\u00e1gina Confluence, reciban notificaciones cuando se a\u00f1aden comentarios en la p\u00e1gina vista y voten y vean problemas JIRA a los que no tienen acceso, aunque no recibir\u00e1n notificaciones para el problema, mediante la falta de comprobaciones de permisos."}], "lastModified": "2019-10-09T23:30:39.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:activity_streams:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A56A311-72BB-47C6-A488-16BD13ED0CCC", "versionEndExcluding": "6.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@atlassian.com"}