CVE-2017-9513
Last modified
CVE-2017-9513 is a vulnerability of currently unknown severity. Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & receive notifications when comments are added to the watched page, and vote & watch JIRA issues that they do not have access to, although they will not receive notifications for the issue, via missing permission checks.. EPSS estimates a 0.67% chance of exploitation in the next 30 days.
Description
Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & receive notifications when comments are added to the watched page, and vote & watch JIRA issues that they do not have access to, although they will not receive notifications for the issue, via missing permission checks.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Activity Streams | < 6.3.0 |
References
- http://www.securityfocus.com/bid/102869Third Party Advisory, VDB Entry
- https://ecosystem.atlassian.net/browse/STRM-2350Vendor Advisory
- http://www.securityfocus.com/bid/102869Third Party Advisory, VDB Entry
- https://ecosystem.atlassian.net/browse/STRM-2350Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-9513?
How severe is CVE-2017-9513?
How do I fix CVE-2017-9513?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-9507The review dashboard resource in Atlassian Crucible from ver…
- CVE-2017-9508Various resources in Atlassian Fisheye and Crucible before v…
- CVE-2017-9509The review file upload resource in Atlassian Crucible before…
- CVE-2017-9510The repository changelog resource in Atlassian Fisheye befor…
- CVE-2017-9511The MultiPathResource class in Atlassian Fisheye and Crucibl…7.5
- CVE-2017-9512The mostActiveCommitters.do resource in Atlassian Fisheye an…7.5
- CVE-2017-9514Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.…
- CVE-2017-9516Craft CMS before 2.6.2982 allows for a potential XSS attack …
- CVE-2017-9517atmail before 7.8.0.2 has CSRF, allowing an attacker to uplo…
- CVE-2017-9518atmail before 7.8.0.2 has CSRF, allowing an attacker to chan…
- CVE-2017-9519atmail before 7.8.0.2 has CSRF, allowing an attacker to crea…
- CVE-2017-9520The r_config_set function in libr/config/config.c in radare2…
Are you affected by CVE-2017-9513?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST