PT-2018-6349 · Atlassian · Crucible+1

David Black · Publicado 2018-02-01 · Atualizado 2019-10-03 · CVE-2017-16861

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Fisheye versions prior to 4.4.5 Fisheye versions 4.5.0 through 4.5.1 Crucible versions prior to 4.4.5 Crucible versions 4.5.0 through 4.5.1

Description: The issue allows for double OGNL evaluation in certain redirect actions and in WebWork URL and Anchor tags in JSP files. An attacker with access to the web interface of Fisheye or Crucible, or who hosts a website visited by a user with such access, can exploit this to execute Java code of their choice on systems running a vulnerable version.

Recommendations: For Fisheye versions prior to 4.4.5, update to version 4.4.5 or later. For Fisheye versions 4.5.0 through 4.5.1, update to version 4.5.2 or later. For Crucible versions prior to 4.4.5, update to version 4.4.5 or later. For Crucible versions 4.5.0 through 4.5.1, update to version 4.5.2 or later.

Correção

Identificadores relacionados

CVE-2017-16861

Produtos afetados

Crucible

Fisheye

Referências · 7

• https://jira.atlassian.com/browse/CRUC-8156 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16861 · Nota de Segurança
• https://confluence.atlassian.com/x/h-QyO · Aviso do Fabricante
• http://securityfocus.com/bid/102971 · Nota
• https://jira.atlassian.com/browse/FE-6991 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-16861 · Aviso do Fabricante
• https://confluence.atlassian.com/x/iPQyO · Aviso do Fabricante