CVE-2017-16862

The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-site request forgery (CSRF) vulnerability.

• CWE-352

• http://www.securityfocus.com/bid/102506Third Party Advisory, VDB Entry
• https://jira.atlassian.com/browse/JRASERVER-66622Patch, Vendor Advisory
• http://www.securityfocus.com/bid/102506Third Party Advisory, VDB Entry
• https://jira.atlassian.com/browse/JRASERVER-66622Patch, Vendor Advisory

Published

Jan 12, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16856The RSS Feed macro in Atlassian Confluence before version 6.…
• CVE-2017-16857It is possible to bypass the bitbucket auto-unapprove plugin…
• CVE-2017-16858The 'crowd-application' plugin module (notably used by the G…
• CVE-2017-16859The review attachment resource in Atlassian Fisheye and Cruc…
• CVE-2017-16860The invalidRedirectUrl template in Atlassian Application Lin…
• CVE-2017-16861It was possible for double OGNL evaluation in certain redire…
• CVE-2017-16863The PieChart gadget in Atlassian Jira before version 7.5.3 a…
• CVE-2017-16864The issue search resource in Atlassian Jira before version 7…
• CVE-2017-16865The Trello importer in Atlassian Jira before version 7.6.1 a…
• CVE-2017-16866dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Script…
• CVE-2017-16867Amazon Key through 2017-11-16 mishandles Cloud Cam 802.11 de…
• CVE-2017-16868In SWFTools 0.9.2, the wav_convert2mono function in lib/wav.…