CVE-2019-15005
Description
The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira Server / Data Center before 8.3.2, Crowd / Crowd Data Center before 3.6.0, Fisheye before 4.7.2, Crucible before 4.7.2, and Bamboo before 6.10.2.
How to fix
- atlassian troubleshooting_and_support1.17.2 or later
- atlassian bamboo6.10.2 or later
- atlassian bitbucket6.6.0 or later
- atlassian confluence7.0.1 or later
- atlassian crowd3.6.0 or later
- atlassian crucible4.7.2 or later
- atlassian fisheye4.7.2 or later
- atlassian jira8.3.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian troubleshooting_and_support | v < 1.17.2 | 1.17.2 |
| atlassian bamboo | v < 6.10.2 | 6.10.2 |
| atlassian bitbucket | v < 6.6.0 | 6.6.0 |
| atlassian confluence | v < 7.0.1 | 7.0.1 |
| atlassian crowd | v < 3.6.0 | 3.6.0 |
| atlassian crucible | v < 4.7.2 | 4.7.2 |
| atlassian fisheye | v < 4.7.2 | 4.7.2 |
| atlassian jira | v < 8.3.2 | 8.3.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.