[FE-7252] Improper authorization vulnerability in the /json/profile/removeStarAjax.do resource - CVE-2019-15009 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Medium
Fix Version/s: 4.8.0
Affects Version/s: 4.7.1
Component/s: Repositories
Labels:

Symptom Severity:
Severity 3 - Minor
Bug Fix Policy:
View Atlassian Server bug fix policy

The /json/profile/removeStarAjax.do resource in Atlassian Fisheye before version 4.8.0 allows remote attackers to remove another user's favourite setting for a project via an improper authorization vulnerability.

relates to

CRUC-8443 Improper authorization vulnerability in the /json/profile/removeStarAjax.do resource - CVE-2019-15009

Closed

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Affected customers:: 0 This affects my team

Watchers:: 1 Start watching this issue

Created:: 10/Dec/2019 2:38 AM

Updated:: 11/Dec/2019 1:43 AM

Resolved:: 10/Dec/2019 2:42 AM

Details

Description

Attachments

Issue Links

Forms

Activity

[FE-7252] Improper authorization vulnerability in the /json/profile/removeStarAjax.do resource - CVE-2019-15009

People

Dates