CVE-2016-6668
The Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 before 7.8.17; Confluence HipChat plugin 6.26.0 before 7.8.17; and HipChat for JIRA plugin 6.26.0 before 7.8.17 allows remote attackers to…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.82%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 before 7.8.17; Confluence HipChat plugin 6.26.0 before 7.8.17; and HipChat for JIRA plugin 6.26.0 before 7.8.17 allows remote attackers to obtain the secret key for communicating with HipChat instances by reading unspecified pages.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 3.82% probability · 90th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- atlassian/confluence server · atlassian/jira integration for hipchat
- Source
- cve@mitre.org
EPSS 3.8% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://packetstormsecurity.com/files/139004/Atlassian-HipChat-Secret-Key-Disclosure.htmlThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/539530/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/93159Broken Link, Third Party Advisory, VDB Entry
- https://confluence.atlassian.com/bitbucketserver/bitbucket-server-security-advisory-2016-09-21-840698321.htmlVendor Advisory
- https://confluence.atlassian.com/doc/confluence-security-advisory-2016-09-21-849052104.htmlVendor Advisory
- https://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2016-09-21-849052099.htmlVendor Advisory
- http://packetstormsecurity.com/files/139004/Atlassian-HipChat-Secret-Key-Disclosure.htmlThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/539530/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/93159Broken Link, Third Party Advisory, VDB Entry
- https://confluence.atlassian.com/bitbucketserver/bitbucket-server-security-advisory-2016-09-21-840698321.htmlVendor Advisory
- https://confluence.atlassian.com/doc/confluence-security-advisory-2016-09-21-849052104.htmlVendor Advisory
- https://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2016-09-21-849052099.htmlVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.