CVE-2017-9513

CVE-2017-9513 affects the bundled Atlassian Activity Streams plugin (Confluence context) prior to version 6.3.0. The issue arises from missing permission checks in several REST inline action resources, allowing remote authenticated attackers to watch any Confluence page, receive notifications for...

The bundled Atlassian Activity Streams plugin had Improper Access control inside several rest inline action resource resource - CVE-2017-9506

The version of the bundled Atlassian Activity Streams plugin was vulnerable to Improper Access control. This allowed remote authenticated attackers to watch any Confluence page & receive notifications when comments are added to the watched page, and vote & watch JIRA issues that they do not have...

The bundled Atlassian Activity Streams plugin had Improper Access control inside several rest inline action resource resource - CVE-2017-9506

The version of the bundled Atlassian Activity Streams plugin was vulnerable to Improper Access control. This allowed remote authenticated attackers to watch any Confluence page & receive notifications when comments are added to the watched page, and vote & watch JIRA issues that they do not have...

Activity Streams shows restricted content from Confluence

To reproduce: Create a test user Configure the user to only belong to the 'users' group Remove 'users' group from Confluence global permission, hence, 'users' group won't be able to use Confluence In the activity streams gadget in default JIRA dashboard, test user can still see Confluence...