Highest We have identified and fixed a vulnerability in Stash which allowed unauthenticated users to commit actions on behalf of any other authorised user. In order to exploit this vulnerability, an attacker requires access to your Stash web interface.
The Stash server is only vulnerable if it has been configured to be a part of an Application link with Trusted Applications authentication.
The vulnerability affects all supported versions of Stash up to and including 2.5.3, 2.6.4, 2.7.5 and 2.8.3. It has been fixed in the Stash security patch releases 2.5.4, 2.6.5, 2.7.6, 2.8.4. The vulnerability does not affect the Stash 2.9 and 2.10 releases.
For more information, see our security advisory.
- mentioned in
-
![[Atlassian Documentation] Page](/images/icons/generic_link_16.png "[Atlassian Documentation] Page")
Page
No Confluence page found with the given URL.
-
Page
No Confluence page found with the given URL.
-
Page
No Confluence page found with the given URL.
-
Page
No Confluence page found with the given URL.
-
Page Loading...
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
![[Atlassian Documentation] Page](https://confluence.atlassian.com/images/icons/favicon.png "[Atlassian Documentation] Page"){kind=icon}
| Form Name | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
[BSERV-4122] Privilege escalation
| Remote Link | Original: This issue links to "Page (Atlassian Documentation)" [ 284673 ] |
| Workflow | Original: Stash Workflow - Restricted [ 1447224 ] | New: JAC Bug Workflow v3 [ 3136790 ] |
| Remote Link | Original: This issue links to "Page (Atlassian Documentation)" [ 273926 ] |
| Remote Link | Original: This issue links to "Page (Atlassian Documentation)" [ 284673 ] | New: This issue links to "Page (Atlassian Documentation)" [ 284673 ] |
| Remote Link | New: This issue links to "Page (Atlassian Documentation)" [ 284673 ] |
| Remote Link | Original: This issue links to "Page (Atlassian Documentation)" [ 273926 ] | New: This issue links to "Page (Atlassian Documentation)" [ 273926 ] |
| Remote Link | New: This issue links to "Page (Atlassian Documentation)" [ 273926 ] |
| Remote Link | Original: This issue links to "Page (Atlassian Documentation)" [ 261577 ] | New: This issue links to "Page (Atlassian Documentation)" [ 261577 ] |
| Remote Link | New: This issue links to "Page (Atlassian Documentation)" [ 261577 ] |
| Remote Link | Original: This issue links to "Page (Atlassian Documentation)" [ 252606 ] | New: This issue links to "Page (Atlassian Documentation)" [ 252606 ] |