[JRASERVER-66622] Cross-site request forgery(CSRF) in the IncomingMailServers resource - CVE-2017-16862 - Create and track feature requests for Atlassian products.

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Medium
Resolution: Fixed
Affects Version/s: 6.4
Fix Version/s: 7.7.0, 7.6.2, 7.6.3
Component/s: Mail Server
Labels:
- CVE-2017-16862
- advisory
- advisory-released
- csrf
- cvss-medium
- raid
- security

Fixed in Long Term Support Release/s:

Download 7.6
Introduced in Version:
6.04
Symptom Severity:
Severity 3 - Minor
Bug Fix Policy:
View Atlassian Server bug fix policy

Description

The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-site request forgery (CSRF) vulnerability.

Attachments

Activity

People

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Votes:: 0 Vote for this issue

Watchers:: 4 Start watching this issue

Dates

Created:: 12/Jan/2018 2:26 AM

Updated:: 22/May/2020 8:23 AM

Resolved:: 12/Jan/2018 2:44 AM