CVE-2019-15005
Last modified
CVE-2019-15005 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. EPSS estimates a 1.33% chance of exploitation in the next 30 days.
Description
The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira Server / Data Center before 8.3.2, Crowd / Crowd Data Center before 3.6.0, Fisheye before 4.7.2, Crucible before 4.7.2, and Bamboo before 6.10.2.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Troubleshooting And Support | < 1.17.2 |
| Atlassian | Bamboo | < 6.10.2 |
| Atlassian | Bitbucket | < 6.6.0 |
| Atlassian | Confluence | < 7.0.1 |
| Atlassian | Crowd | < 3.6.0 |
| Atlassian | Crucible | < 4.7.2 |
| Atlassian | Fisheye | < 4.7.2 |
| Atlassian | Jira | < 8.3.2 |
References
- https://jira.atlassian.com/browse/BAM-20647Issue Tracking, Vendor Advisory
- https://jira.atlassian.com/browse/BAM-20647Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-15005?
How severe is CVE-2019-15005?
How do I fix CVE-2019-15005?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-1500Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2019-15000The commit diff rest endpoint in Bitbucket Server and Data C…9.8
- CVE-2019-15001The Jira Importers Plugin in Atlassian Jira Server and Data …7.2
- CVE-2019-15002An exploitable CSRF vulnerability exists in Atlassian Jira, …4.3
- CVE-2019-15003The Customer Context Filter in Atlassian Jira Service Desk S…5.3
- CVE-2019-15004The Customer Context Filter in Atlassian Jira Service Desk S…7.5
- CVE-2019-15006There was a man-in-the-middle (MITM) vulnerability present i…6.5
- CVE-2019-15007The review resource in Atlassian Fisheye and Crucible before…4.8
- CVE-2019-15008The /plugins/servlet/branchreview resource in Atlassian Fish…6.1
- CVE-2019-15009The /json/profile/removeStarAjax.do resource in Atlassian Fi…4.3
- CVE-2019-1501Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2019-15010Bitbucket Server and Bitbucket Data Center versions starting…8.8
Are you affected by CVE-2019-15005?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST