CVE-2017-9505

Published: Jun 15, 2017Modified: May 13, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments added to a page after they started watching it even if they do not have permission to view the page itself.

Affected (1)

Products: Atlassian: Confluence

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Atlassian Confluence	From 4.3 to 6.2.1

Related CWEs

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

References (6)

http://www.securityfocus.com/bid/99086

Source: security@atlassian.com

Third Party AdvisoryVDB Entry

https://jira.atlassian.com/browse/CONFSERVER-52560

Source: security@atlassian.com

MitigationVendor Advisory

https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170613-0_Atlassian_Confluence_Access_Restriction_Bypass_v10.txt

Source: security@atlassian.com

ExploitMitigationThird Party Advisory

http://www.securityfocus.com/bid/99086

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://jira.atlassian.com/browse/CONFSERVER-52560

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationVendor Advisory

https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170613-0_Atlassian_Confluence_Access_Restriction_Bypass_v10.txt

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMitigationThird Party Advisory

Timeline

No history available yet.