CVE-2019-15005
Atlassian Bitbucket Server
MEDIUM 4.3
At a glance
- Source
- NVD
- EPSS
- EPSS 1.33 % · percentile 71 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- atlassian
- NVD status
- Modified
Description
The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira Server / Data Center before 8.3.2, Crowd / Crowd Data Center before 3.6.0, Fisheye before 4.7.2, Crucible before 4.7.2, and Bamboo before 6.10.2.
Weaknesses (CWE)
- CWE-862 — Missing Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2019-6092
- GCVE · GCVE-0-2019-15005
Affected configurations (NVD CPE)
cpe:2.3:a:atlassian:troubleshooting_and_support:*:*:*:*:*:*:*:*< 1.17.2cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*< 6.10.2cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*< 6.6.0cpe:2.3:a:atlassian:confluence:*:*:*:*:*:*:*:*< 7.0.1cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*< 3.6.0cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*< 4.7.2cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*< 4.7.2cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*< 8.3.2
Affected products
| Product | Versions |
|---|---|
| Atlassian · Bitbucket Server | affected unspecified < 6.6.0 |
| Atlassian · Jira Server | affected unspecified < 8.3.2 |
| Atlassian · Confluence Server | affected unspecified < 7.0.1 |
| Atlassian · Crowd | affected unspecified < 3.6.0 |
| Atlassian · Fisheye | affected unspecified < 4.7.2 |
| Atlassian · Crucible | affected unspecified < 4.7.2 |
| Atlassian · Bamboo | affected unspecified < 6.10.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |