CVE-2015-8481: Infoleak

Published Jan 8, 2016

Updated

Atlassian JIRA Software 7.0.3, JIRA Core 7.0.3, and the bundled JIRA Service Desk 3.0.3 installer attaches the wrong image to e-mail notifications when a user views an issue with inline wiki markup referencing an image attachment, which might allow remote attackers to obtain sensitive information by updating a different issue that includes wiki markup for an external image reference.

Affected Software

3 affected components

Atlassian JIRA Core=7.0.3

Atlassian Jira Server=7.0.3

Atlassian Jira Service Desk=3.0.3

Event History

Jan 8, 2016

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-8481?

CVE-2015-8481 is classified as a medium severity vulnerability.

How do I fix CVE-2015-8481?

To fix CVE-2015-8481, upgrade to a patched version of Atlassian JIRA Software or Service Desk that resolves this issue.

What products are affected by CVE-2015-8481?

CVE-2015-8481 affects Atlassian JIRA Core 7.0.3, JIRA Software 7.0.3, and JIRA Service Desk 3.0.3.

What is the impact of CVE-2015-8481?

The impact of CVE-2015-8481 allows remote attackers to potentially obtain sensitive information through incorrect image attachments in email notifications.

When was CVE-2015-8481 published?

CVE-2015-8481 was published on December 9, 2015.