Cross-site Request Forgery Vulnerability in Atlassian Confluence Questions
CVE-2018-13393

6.5MEDIUM

Key Information:

Vendor

Atlassian
Status
Confluence Questions
Vendor
CVE Published:
15 August 2018

What is CVE-2018-13393?

In Atlassian Confluence Questions prior to version 2.6.6, a Cross-site Request Forgery vulnerability is present in the convertCommentToAnswer resource. This flaw allows remote attackers to manipulate comments, converting them into answers without proper authorization, potentially leading to unauthorized content modifications.

Affected Version(s)

Confluence Questions < 2.6.6

References

http://www.securityfocus.com/bid/105155
vdb-entryx_refsource_BID
https://jira.atlassian.com/browse/CONFSERVER-56282
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.