The Webhooks component of Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.11.0 allows remote attackers who are able to observe or otherwise intercept webhook events to learn information about changes in issues that should not be sent because they are not contained within the results of a specified JQL query.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is version 7.0.x prior to 7.6.7 or 7.7.0 prior to 7.11.0. It is, therefore, affected by a vulnerability which permits remote attackers who are able to observe or otherwise intercept webhook events to learn information about changes in issues outside the results of a JQL query.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by an information disclosure vulnerability due to webhook events being sent improperly due to issues in the related JQL filter.

ID	Name	Product	Family	Severity
113803	Atlassian Jira 7.7.0 < 7.11.0 Broken Jql Filter For Webhooks	Web App Scanning	Component Vulnerability	medium
113802	Atlassian Jira 7.0.0 < 7.6.7 Broken Jql Filter For Webhooks	Web App Scanning	Component Vulnerability	medium
122593	Atlassian JIRA < 7.6.7 / 7.7.x < 7.11.0 Information Disclosure	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2017-18104

medium

Tenable Plugins

medium

medium

medium