PT-2017-13561 · Atlassian · Hipchat+1

Robbie · Publicado 2017-11-27 · Atualizado 2017-12-20 · CVE-2017-14585

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hipchat Server versions 2.2.0 through 2.2.6 Hipchat Data Center versions 3.0.0 through 3.1.0

Description A Server Side Request Forgery (SSRF) issue could lead to remote code execution for authenticated administrators.

Recommendations For Hipchat Server versions 2.2.0 through 2.2.6, update to a version after 2.2.6 to resolve the issue. For Hipchat Data Center versions 3.0.0 through 3.1.0, update to a version after 3.1.0 to resolve the issue.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2017-14585

Produtos afetados

Hipchat

Ichat Server

Referências · 5

• https://jira.atlassian.com/browse/HCPUB-3526 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-14585 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14585 · Nota de Segurança
• http://securityfocus.com/bid/101945 · Nota
• https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-11-22-939946293.html · Aviso do Fabricante