Description
The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira Server / Data Center before 8.3.2, Crowd / Crowd Data Center before 3.6.0, Fisheye before 4.7.2, Crucible before 4.7.2, and Bamboo before 6.10.2.
Remediation
References
Related Vulnerabilities
WordPress Plugin Advanced Dynamic Pricing for WooCommerce Multiple Vulnerabilities (4.1.5)
WordPress Plugin Contest Gallery-Photo Contest for WordPress Cross-Site Scripting (14.1.7)
MediaWiki Insufficiently Protected Credentials Vulnerability (CVE-2020-29005)
TYPO3 Insertion of Sensitive Information into Log File Vulnerability (CVE-2021-32767)
WordPress Plugin Contact Form 7 Datepicker Cross-Site Scripting (2.6.0)