CVE-2017-18095

State: Published
Severity: Not scored
Published: Feb 19, 2018
Updated: Sep 16, 2024
Reserved: Feb 1, 2018

Description

The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 (the fixed version 4.5.x) and before 4.6.0 allows remote attackers to comment on snippets they do not have authorization to access via an improper authorization vulnerability.

Scores

The record has no CVSS score.

Weaknesses

CWE-863 Incorrect Authorization (CWE-863)

Affected Products

Product	Versions
CrucibleAtlassian	prior to 4.5.1Affected prior to 4.6.0Affected

References

103207vdb-entry
https://jira.atlassian.com/browse/CRUC-8178

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.