Description
The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira Server / Data Center before 8.3.2, Crowd / Crowd Data Center before 3.6.0, Fisheye before 4.7.2, Crucible before 4.7.2, and Bamboo before 6.10.2.
Remediation
References
Related Vulnerabilities
WordPress Plugin Row Seats Core Unspecified Vulnerability (2.66)
qdPM Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2020-26165)
WordPress Plugin Book appointment online Cross-Site Scripting (1.38)
ReviveAdserver Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-7371)
WordPress Plugin Contact Form 7 International Sms Integration Cross-Site Scripting (1.2)