{"containers": {"cna": {"affected": [{"product": "Confluence Server", "vendor": "Atlassian", "versions": [{"status": "affected", "version": "Versions of Confluence starting with 4.3.0 before 6.2.1 are affected by this vulnerability."}]}], "datePublic": "2017-06-13T00:00:00", "descriptions": [{"lang": "en", "value": "Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments added to a page after they started watching it even if they do not have permission to view the page itself."}], "problemTypes": [{"descriptions": [{"description": "Access Restriction Bypass", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-06-19T09:57:01", "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian"}, "references": [{"name": "99086", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/99086"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://jira.atlassian.com/browse/CONFSERVER-52560"}, {"tags": ["x_refsource_MISC"], "url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170613-0_Atlassian_Confluence_Access_Restriction_Bypass_v10.txt"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@atlassian.com", "ID": "CVE-2017-9505", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Confluence Server", "version": {"version_data": [{"version_value": "Versions of Confluence starting with 4.3.0 before 6.2.1 are affected by this vulnerability."}]}}]}, "vendor_name": "Atlassian"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments added to a page after they started watching it even if they do not have permission to view the page itself."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Access Restriction Bypass"}]}]}, "references": {"reference_data": [{"name": "99086", "refsource": "BID", "url": "http://www.securityfocus.com/bid/99086"}, {"name": "https://jira.atlassian.com/browse/CONFSERVER-52560", "refsource": "CONFIRM", "url": "https://jira.atlassian.com/browse/CONFSERVER-52560"}, {"name": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170613-0_Atlassian_Confluence_Access_Restriction_Bypass_v10.txt", "refsource": "MISC", "url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170613-0_Atlassian_Confluence_Access_Restriction_Bypass_v10.txt"}]}}}}, "cveMetadata": {"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "assignerShortName": "atlassian", "cveId": "CVE-2017-9505", "datePublished": "2017-06-15T16:00:00", "dateReserved": "2017-06-07T00:00:00", "dateUpdated": "2017-06-19T09:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:confluence:*:*:*:*:*:*:*:*", "matchCriteriaId": "9806EAE9-4652-46DF-866A-B580435705E4", "versionEndExcluding": "6.2.1", "versionStartIncluding": "4.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments added to a page after they started watching it even if they do not have permission to view the page itself."}, {"lang": "es", "value": "Atlassian Confluence desde la versi\u00f3n 4.3.0 hasta la 6.2.1 no comprobaba si un usuario ten\u00eda permiso para visualizar una p\u00e1gina mientras se creaba una notificaci\u00f3n workbox sobre nuevos comentarios. Un atacante que pueda iniciar sesi\u00f3n en Confluence podr\u00eda recibir notificaciones workbox, que contienen los comentarios, para los comentarios a\u00f1adidos a una p\u00e1gina una vez que han empezado a verla aunque no tengan permiso para visualizar la propia p\u00e1gina."}], "id": "CVE-2017-9505", "lastModified": "2020-07-21T16:50:16.893", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-06-15T16:29:00.233", "references": [{"source": "security@atlassian.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99086"}, {"source": "security@atlassian.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/CONFSERVER-52560"}, {"source": "security@atlassian.com", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170613-0_Atlassian_Confluence_Access_Restriction_Bypass_v10.txt"}], "sourceIdentifier": "security@atlassian.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}