CVE-2017-9505

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-06-15 · updated 2026-06-17
Weakness: CWE-276

Description

Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments added to a page after they started watching it even if they do not have permission to view the page itself.

Affected products

Atlassian Confluence: from 4.3 before 6.2.1 — fixed in 6.2.1

How to fix

Upgrade to a fixed version: Atlassian Confluence 6.2.1. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/99086
https://jira.atlassian.com/browse/CONFSERVER-52560
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170613-0_Atlassian_Confluence_Access_Restriction_Bypass_v10.txt
http://www.securityfocus.com/bid/99086
https://jira.atlassian.com/browse/CONFSERVER-52560
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170613-0_Atlassian_Confluence_Access_Restriction_Bypass_v10.txt

Get alerted when CVE-2017-9505 or the next vulnerability affects your stack