CVE-2017-18104

Опубликовано: 24 июл. 2018

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

The Webhooks component of Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.11.0 allows remote attackers who are able to observe or otherwise intercept webhook events to learn information about changes in issues that should not be sent because they are not contained within the results of a specified JQL query.

Ссылки

https://jira.atlassian.com/browse/JRASERVER-59980
Exploit
Vendor Advisory
https://jira.atlassian.com/browse/JRASERVER-59980
Exploit
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*

Версия до 7.6.7 (исключая)

cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*

Версия от 7.7.0 (включая) до 7.11.0 (исключая)

EPSS

Процентиль: 50%

0.00272

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-3fq6-pwph-4674