CVE-2019-15005 Missing authorization in Bamboo
Unprivileged users can trigger log scans and receive configuration data via email due to missing authorization checks in the Atlassian Troubleshooting and Support Tools plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-15005?
CVE-2019-15005 is a medium-severity missing authorization vulnerability in Atlassian Crucible, published on 8 Nov 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira Server / Data Center before 8.3.2, Crowd / Crowd Data Center before 3.6.0, Fisheye before 4.7.2, Crucible before 4.7.2, and Bamboo before 6.10.2.
Weakness: CWE-862
Which versions are affected by CVE-2019-15005?
It affects 8 products.
Products include Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence, Atlassian Crowd, Atlassian Crucible, Atlassian Fisheye and 2 more.
How do I fix CVE-2019-15005?
No fix has been published for CVE-2019-15005 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-15005 being exploited?
There is no known exploitation of CVE-2019-15005 in the wild and no public exploit code.
Other vulnerabilities in Atlassian Crucible
Sources
Also known as GHSA-3xw8-mq4w-hh6g.