Description
The Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 before 7.8.17; Confluence HipChat plugin 6.26.0 before 7.8.17; and HipChat for JIRA plugin 6.26.0 before 7.8.17 allows remote attackers to obtain the secret key for communicating with HipChat instances by reading unspecified pages.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.securityfocus.com/archive/1/539530/100/0/threaded ↗
- https://confluence.atlassian.com/bitbucketserver/bitbucket-server-security-advisory-2016-09-21-840698321.html ↗
- https://confluence.atlassian.com/doc/confluence-security-advisory-2016-09-21-849052104.html ↗
- http://www.securityfocus.com/bid/93159 ↗
- https://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2016-09-21-849052099.html ↗
- http://packetstormsecurity.com/files/139004/Atlassian-HipChat-Secret-Key-Disclosure.html ↗