Atlassian JIRA CVE-2017-16862 Cross Site Request Forgery Vulnerability
BID:102506
CVE-2017-16862 |Info
Atlassian JIRA CVE-2017-16862 Cross Site Request Forgery Vulnerability
| Bugtraq ID: | 102506 |
| Class: | Design Error |
| CVE: |
CVE-2017-16862 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 12 2018 12:00AM |
| Updated: | Jan 12 2018 12:00AM |
| Credit: | The vendor reported this issue. |
| Vulnerable: |
Atlassian JIRA 5.0.1 0 Atlassian JIRA 5.0 0 Atlassian JIRA 7.4.2 Atlassian JIRA 7.2.1 Atlassian JIRA 7.2 Atlassian JIRA 7.1.10 Atlassian JIRA 7.1.9 Atlassian JIRA 7.1.8 Atlassian JIRA 7.1.7 Atlassian JIRA 7.1.6 Atlassian JIRA 7.1.5 Atlassian JIRA 7.1.4 Atlassian JIRA 7.1.2 Atlassian JIRA 7.1.1 Atlassian JIRA 7.1 Atlassian JIRA 7.0.11 Atlassian JIRA 7.0.4 Atlassian JIRA 7.0.3 Atlassian JIRA 6.4.11 Atlassian JIRA 6.4.8 Atlassian JIRA 6.3.5 Atlassian JIRA 6.2.7 Atlassian JIRA 6.2.5 Atlassian JIRA 6.1.4 Atlassian JIRA 6.1.3 Atlassian JIRA 6.0.3 Atlassian JIRA 6.0.2 Atlassian JIRA 6.0 Atlassian JIRA 5.1.5 Atlassian JIRA 5.1.4 Atlassian JIRA 5.1.1 Atlassian JIRA 5.1 Atlassian JIRA 5.0.6 Atlassian JIRA 4.4.5 Atlassian JIRA 4.3.4 Atlassian JIRA 4.3.3 Atlassian JIRA 4.2.4 Atlassian JIRA 4.2.2 Atlassian JIRA 4.2.1 Atlassian JIRA 4.1.2 Atlassian JIRA 4.1.1 Atlassian JIRA 4.0.2 Atlassian JIRA 4.0.1 Atlassian JIRA 7.2.2 Atlassian JIRA 6.3 Atlassian JIRA 6.0.7 Atlassian JIRA 6.0.5 Atlassian JIRA 6.0.4 Atlassian JIRA 6.0.1 Atlassian JIRA 4.4 Atlassian JIRA 4.3 Atlassian JIRA 4.2 Atlassian JIRA 4.1 Atlassian JIRA 4.0 Atlassian JIRA 3.3 Atlassian JIRA 3.2.3 Atlassian JIRA 3.2.2 Atlassian JIRA 3.2.1 |
| Not Vulnerable: |
Atlassian JIRA 7.7 Atlassian JIRA 7.6.3 Atlassian JIRA 7.6.2 |
Discussion
Atlassian JIRA CVE-2017-16862 Cross Site Request Forgery Vulnerability
Atlassian JIRA is prone to a cross-site request-forgery vulnerability because it fails to properly validate HTTP requests.
Exploiting this issue allows a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.
Atlassian JIRA is prone to a cross-site request-forgery vulnerability because it fails to properly validate HTTP requests.
Exploiting this issue allows a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.
Exploit / POC
Atlassian JIRA CVE-2017-16862 Cross Site Request Forgery Vulnerability
An attacker can exploit this issue using a web browser.
An attacker can exploit this issue using a web browser.
Solution / Fix
Atlassian JIRA CVE-2017-16862 Cross Site Request Forgery Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Atlassian JIRA CVE-2017-16862 Cross Site Request Forgery Vulnerability
References:
References: