CVE-2016-6668: Infoleak

Published Jan 23, 2017

Updated

The Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 before 7.8.17; Confluence HipChat plugin 6.26.0 before 7.8.17; and HipChat for JIRA plugin 6.26.0 before 7.8.17 allows remote attackers to obtain the secret key for communicating with HipChat instances by reading unspecified pages.

Affected Software

30 affected components

Atlassian Confluence Server=5.5.0

Atlassian Confluence Server=5.9.1

Atlassian Confluence Server=5.9.2

Atlassian Confluence Server=5.9.3

Atlassian Confluence Server=5.9.4

Atlassian Confluence Server=5.9.5

Atlassian Confluence Server=5.9.6

Atlassian Confluence Server=5.9.7

Atlassian Confluence Server=5.9.8

Atlassian Confluence Server=5.9.9

Atlassian Confluence Server=5.9.10

Atlassian Confluence Server=5.9.11

Atlassian Confluence Server=5.9.12

Atlassian Confluence Server=5.10.0

Atlassian Confluence Server=5.10.1

Atlassian Confluence Server=5.10.2

Atlassian Confluence Server=5.10.3

Atlassian Jira Integration For Hipchat=6.26.0

Atlassian Jira Integration For Hipchat=6.26.10

Atlassian Jira Integration For Hipchat=6.29.1

Atlassian Jira Integration For Hipchat=6.29.2

Atlassian Jira Integration For Hipchat=6.31.0

Atlassian Jira Integration For Hipchat=7.1.0

Atlassian Jira Integration For Hipchat=7.2.1

Atlassian Jira Integration For Hipchat=7.3.2

Atlassian Jira Integration For Hipchat=7.3.3

Atlassian Jira Integration For Hipchat=7.4.1

Atlassian Jira Integration For Hipchat=7.8.1

Atlassian Jira Integration For Hipchat=7.8.3

Atlassian Jira Integration For Hipchat=7.8.12

Event History

Jan 23, 2017

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Data Sourced

via NVD·09:59 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2016-6668?

CVE-2016-6668 has been rated as a medium severity vulnerability due to its potential to allow unauthorized access to sensitive information.

How do I fix CVE-2016-6668?

To fix CVE-2016-6668, you should update the vulnerable Atlassian Hipchat Integration Plugin to versions 6.27.5 or higher, or the respective plugin versions in Confluence and JIRA listed in the advisory.

What systems are affected by CVE-2016-6668?

CVE-2016-6668 affects various versions of the Atlassian Hipchat Integration Plugin for Bitbucket Server, Confluence HipChat plugin, and HipChat for JIRA.

What type of attack does CVE-2016-6668 enable?

CVE-2016-6668 allows remote attackers to potentially obtain the secret key used for communications with HipChat, leading to unauthorized access.

Is there a patch available for CVE-2016-6668?

Yes, a patch is available by upgrading to the latest versions of the affected plugins as indicated in the vulnerability advisory.