CVE-2017-9505

Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments added to a page after they started watching it even if they do not have permission to view the page itself.

• CWE-276

• http://www.securityfocus.com/bid/99086Third Party Advisory, VDB Entry
• https://jira.atlassian.com/browse/CONFSERVER-52560Mitigation, Vendor Advisory
• https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170613-0_Atlassian_Confluence_Access_Restriction_Bypass_v10.txtExploit, Mitigation, Third Party Advisory
• http://www.securityfocus.com/bid/99086Third Party Advisory, VDB Entry
• https://jira.atlassian.com/browse/CONFSERVER-52560Mitigation, Vendor Advisory
• https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170613-0_Atlassian_Confluence_Access_Restriction_Bypass_v10.txtExploit, Mitigation, Third Party Advisory

Published

Jun 15, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-9499In ImageMagick 7.0.5-7 Q16, an assertion failure was found i…
• CVE-2017-9500In ImageMagick 7.0.5-8 Q16, an assertion failure was found i…
• CVE-2017-9501In ImageMagick 7.0.5-7 Q16, an assertion failure was found i…
• CVE-2017-9502In curl before 7.54.1 on Windows and DOS, libcurl's default …
• CVE-2017-9503QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708…5.5
• CVE-2017-9504Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-9506The IconUriServlet of the Atlassian OAuth Plugin from versio…
• CVE-2017-9507The review dashboard resource in Atlassian Crucible from ver…
• CVE-2017-9508Various resources in Atlassian Fisheye and Crucible before v…
• CVE-2017-9509The review file upload resource in Atlassian Crucible before…
• CVE-2017-9510The repository changelog resource in Atlassian Fisheye befor…
• CVE-2017-9511The MultiPathResource class in Atlassian Fisheye and Crucibl…7.5