CVE-2019-15005: The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results…

PriorityP423medium4.3CVSS 3.1

AVNACLPRLUINSUCLINAN

EPSS

1.33%

67.9th percentile

The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira Server / Data Center before 8.3.2, Crowd / Crowd Data Center before 3.6.0, Fisheye before 4.7.2, Crucible before 4.7.2, and Bamboo before 6.10.2.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
atlassian	bamboo	< 6.10.2	6.10.2
atlassian	bamboo	>= unspecified < 6.10.2	6.10.2
atlassian	bitbucket	< 6.6.0	6.6.0
atlassian	bitbucket_server	>= unspecified < 6.6.0	6.6.0
atlassian	confluence	< 7.0.1	7.0.1
atlassian	confluence_server	>= unspecified < 7.0.1	7.0.1
atlassian	crowd	< 3.6.0	3.6.0
atlassian	crowd	>= unspecified < 3.6.0	3.6.0
atlassian	crucible	< 4.7.2	4.7.2
atlassian	crucible	>= unspecified < 4.7.2	4.7.2
atlassian	fisheye	< 4.7.2	4.7.2
atlassian	fisheye	>= unspecified < 4.7.2	4.7.2
atlassian	jira	< 8.3.2	8.3.2
atlassian	jira_server	>= unspecified < 8.3.2	8.3.2
atlassian	troubleshooting_and_support	< 1.17.2	1.17.2

CVSS provenance

nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.