CVE-2018-13393

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
6.5MEDIUM
EPSS
0.1%
top 75.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Atlassian Confluence QuestionsAtlassian Questions FOR Confluence
Timeline
PublishedAug 15
Latest updateMay 14

Description

The convertCommentToAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated to a fixed version in Confluence version 6.9.0, allows remote attackers to modify a comment into an answer via a Cross-site request forgery (CSRF) vulnerability.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5atlassian/confluence_questionsunspecified — 2.6.6
▶NVDatlassian/questions< 2.6.6

🔴Vulnerability Details

2
GHSA
GHSA-hggm-r8hf-gwj5: The convertCommentToAnswer resource in Atlassian Confluence Questions before version 2↗2022-05-14
▶
CVEList
CVE-2018-13393: The convertCommentToAnswer resource in Atlassian Confluence Questions before version 2↗2018-08-15
▶