CVE-2019-15005

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira Server / Data Center before 8.3.2, Crowd / Crowd Data Center before 3.6.0, Fisheye before 4.7.2, Crucible before 4.7.2, and Bamboo before 6.10.2.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Atlassian	Bitbucket Server	>= unspecified, < 6.6.0
Atlassian	Jira Server	>= unspecified, < 8.3.2
Atlassian	Confluence Server	>= unspecified, < 7.0.1
Atlassian	Crowd	>= unspecified, < 3.6.0
Atlassian	Fisheye	>= unspecified, < 4.7.2
Atlassian	Crucible	>= unspecified, < 4.7.2
Atlassian	Bamboo	>= unspecified, < 6.10.2

References

https://herolab.usd.de/security-advisories/usd-2019-0016/
https://jira.atlassian.com/browse/BAM-20647Issue Tracking, Vendor Advisory
https://herolab.usd.de/security-advisories/usd-2019-0016/
https://jira.atlassian.com/browse/BAM-20647Issue Tracking, Vendor Advisory

Timeline

Published: Nov 8, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-150066.5There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center CVE-2019-150074.8The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript vi CVE-2019-150086.1The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrar CVE-2019-150094.3The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove anothe CVE-2019-150108.8Bitbucket Server and Bitbucket Data Center versions starting from version 3.0.0 before version 5.16.11, from version 6.0.0 before 6.0.11, fr CVE-2019-150114.3The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 CVE-2019-150128.8Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.CVE-2019-150134.3The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5 CVE-2019-150148.8A command injection vulnerability exists in the Zingbox Inspector versions 1.286 and earlier, that allows for an authenticated user to execu CVE-2019-150158.4In the Zingbox Inspector, versions 1.294 and earlier, hardcoded credentials for root and inspector user accounts are present in the system s CVE-2019-150168.8An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1.288 and earlier, that allows for unsanitiz CVE-2019-150178.4The SSH service is enabled on the Zingbox Inspector versions 1.294 and earlier, exposing SSH to the local network. When combined with PAN-SA