CVE-2017-18095

EPSS 0.21%
Veröffentlicht 19.02.2018 14:29:00
Zuletzt bearbeitet 21.11.2024 03:19:21
Quelle security@atlassian.com
CVE-Watchlists
Login
Unerledigt
Login

The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 (the fixed version 4.5.x) and before 4.6.0 allows remote attackers to comment on snippets they do not have authorization to access via an improper authorization vulnerability.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Atlassian ≫ Crucible Version < 4.5.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.21%	0.399

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.3	3.9	1.4	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:P/A:N

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

http://www.securityfocus.com/bid/103207

Third Party Advisory

VDB Entry

https://jira.atlassian.com/browse/CRUC-8178

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2017-18095

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2017-18095

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2017-18095

EUVD