PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6668 Atlassian CVE debrief

CVE-2016-6668 is a secret-disclosure issue in several Atlassian HipChat integration plugins. An attacker able to read certain pages in affected deployments could obtain the secret key used to communicate with HipChat instances. NVD rates the issue as High severity because it is network exploitable, requires no privileges or user interaction, and impacts confidentiality.

Vendor
Atlassian
Product
Confluence Server
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Administrators and security teams managing Atlassian Bitbucket Server, Confluence, or JIRA environments that use the HipChat integration plugins. This is especially important for any deployment still running an affected plugin version or where HipChat integration secrets may not have been rotated.

Technical summary

The CVE description states that the Atlassian Hipchat Integration Plugin for Bitbucket Server, the Confluence HipChat plugin, and the HipChat for JIRA plugin allowed remote attackers to obtain the secret key used for communicating with HipChat instances by reading unspecified pages. Affected versions named in the description are Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 before 7.8.17; Confluence HipChat plugin 6.26.0 before 7.8.17; and HipChat for JIRA plugin 6.26.0 before 7.8.17. NVD maps the weakness to CWE-200 and assigns CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Defensive priority

High. The issue is remotely reachable, requires no authentication, and exposes a secret used for service communication, so affected systems should be patched and checked promptly.

Recommended defensive actions

  • Upgrade the affected Atlassian plugins to the fixed versions identified in the CVE description.
  • Inventory Bitbucket Server, Confluence, and JIRA instances to confirm whether any affected HipChat integration plugin is installed.
  • Rotate or reissue any HipChat communication secret keys after remediation, especially if exposure cannot be ruled out.
  • Review access controls for any pages or content that could reveal integration secrets and restrict access appropriately.
  • Remove or disable the HipChat integration plugin on systems where it is not needed.

Evidence notes

The CVE was published on 2017-01-23 and later modified on 2026-05-13. The supplied NVD record classifies the issue as CVSS 3.1 High (7.5) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N and CWE-200. NVD references Atlassian vendor advisories and third-party advisories. No CISA KEV entry was supplied in the corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-6668 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-6668

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-6668 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-6668

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.