QwikSec

Security Database

CVE

CWE

Training

CVE-2017-9505

Published: Jun 15, 2017

Modified: Oct 16, 2024

PUBLISHED

Description

Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments added to a page after they started watching it even if they do not have permission to view the page itself.

Vendor	Product	Versions
Atlassian	Confluence Server	affected `Versions of Confluence starting with 4.3.0 before 6.2.1 are affected by this vulnerability.`

References

vdb-entry

x_refsource_BID

https://jira.atlassian.com/browse/CONFSERVER-52560

x_refsource_CONFIRM

https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170613-0_Atlassian_Confluence_Access_Restriction_Bypass_v10.txt

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.