Information disclosure in Jira Software Server - CVE-2017-18104
Published: July 30, 2018
Vulnerability identifier: #VU14119
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-18104
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The vulnerability exists due to arbitrary data are not contained within the results of a specified JQL query. A remote attacker who is able to observe or otherwise intercept webhook events can learn information about changes in issues that should not be sent.
Affected software
Jira Software Server
How to mitigate CVE-2017-18104
Update to versions 7.6.7, 7.11.0.
Jira Software Server - addressed in versions 7.6.7, 7.11.0