CVE-2017-9505
CVE-2017-9505
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 1.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
15 Jun 2017Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments added to a page after they started watching it even if they do not have permission to view the page itself.
Affected products
Atlassian · Confluence ServerWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →