CVE-2017-9505: Medium severity atlassian confluence vulnerability
Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments added to a page after they started watching it even if they do not have permission to view the page itself.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9505?
CVE-2017-9505 has a severity rating of medium as it allows unauthorized users to view comments they shouldn't have access to.
How do I fix CVE-2017-9505?
To fix CVE-2017-9505, upgrade Atlassian Confluence to version 6.2.1 or later.
Who is affected by CVE-2017-9505?
All users of Atlassian Confluence versions between 4.3.0 and 6.2.1 are affected by CVE-2017-9505.
What is the impact of CVE-2017-9505?
The impact of CVE-2017-9505 is that unauthorized users can receive notifications containing potentially sensitive comments.
Can CVE-2017-9505 be exploited remotely?
CVE-2017-9505 requires an attacker to have valid login credentials for Confluence to exploit the vulnerability.