CVE-2017-9505

Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new…

published June 15, 2017

CVSS
—
EPSS
1%
Percentile
69.3
In the wild
Unconfirmed
What it is

Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments added to a page after they started watching it even if they do not have permission to view the page itself.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01264 · 69.3th percentile
Published
2017-06-15T16:00Z
EPSS history
Timeline
  • 15 JUN 16:00Z
    Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new…
    cvelistv5