Information disclosure in Jira Software - CVE-2017-18104
Published: July 30, 2018
Vulnerability identifier: #VU14119
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-18104
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Atlassian
Affected software:
Jira Software
Jira Software
Detailed vulnerability description
The disclosed vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The vulnerability exists due to arbitrary data are not contained within the results of a specified JQL query. A remote attacker who is able to observe or otherwise intercept webhook events can learn information about changes in issues that should not be sent.
How to mitigate CVE-2017-18104
Update to versions 7.6.7, 7.11.0.