PT-2012-4372 · Atlassian · Jira+4

Trevor Hartman + 1 · Published 2012-05-22 · Updated 2021-12-13 · CVE-2012-2926

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Atlassian JIRA versions prior to 5.0.1 Atlassian Confluence versions prior to 3.5.16 Atlassian Confluence versions 4.0 prior to 4.0.7 Atlassian Confluence versions 4.1 prior to 4.1.10 Atlassian FishEye and Crucible versions 2.5 prior to 2.5.8 Atlassian FishEye and Crucible versions 2.6 prior to 2.6.8 Atlassian FishEye and Crucible versions 2.7 prior to 2.7.12 Atlassian Bamboo versions 3.3 prior to 3.3.4 Atlassian Bamboo versions 3.4 prior to 3.4.5 Atlassian Crowd versions 2.0 prior to 2.0.9 Atlassian Crowd versions 2.1 prior to 2.1.2 Atlassian Crowd versions 2.2 prior to 2.2.9 Atlassian Crowd versions 2.3 prior to 2.3.7 Atlassian Crowd versions 2.4 prior to 2.4.1

Description The issue allows remote attackers to read arbitrary files or cause a denial of service due to improper restriction of the capabilities of third-party XML parsers.

Recommendations For Atlassian JIRA versions prior to 5.0.1, update to version 5.0.1 or later. For Atlassian Confluence versions prior to 3.5.16, update to version 3.5.16 or later. For Atlassian Confluence versions 4.0 prior to 4.0.7, update to version 4.0.7 or later. For Atlassian Confluence versions 4.1 prior to 4.1.10, update to version 4.1.10 or later. For Atlassian FishEye and Crucible versions 2.5 prior to 2.5.8, update to version 2.5.8 or later. For Atlassian FishEye and Crucible versions 2.6 prior to 2.6.8, update to version 2.6.8 or later. For Atlassian FishEye and Crucible versions 2.7 prior to 2.7.12, update to version 2.7.12 or later. For Atlassian Bamboo versions 3.3 prior to 3.3.4, update to version 3.3.4 or later. For Atlassian Bamboo versions 3.4 prior to 3.4.5, update to version 3.4.5 or later. For Atlassian Crowd versions 2.0 prior to 2.0.9, update to version 2.0.9 or later. For Atlassian Crowd versions 2.1 prior to 2.1.2, update to version 2.1.2 or later. For Atlassian Crowd versions 2.2 prior to 2.2.9, update to version 2.2.9 or later. For Atlassian Crowd versions 2.3 prior to 2.3.7, update to version 2.3.7 or later. For Atlassian Crowd versions 2.4 prior to 2.4.1, update to version 2.4.1 or later.

Exploit

Fix

Related Identifiers

CVE-2012-2926

Affected Products

Bamboo

Confluence

Crowd

Fisheye/Crucible

Jira

References · 15

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/atlassian_crowd_fileaccess.rb · Exploit
• 🔥 https://exploit-db.com/exploits/37218 · Exploit
• http://confluence.atlassian.com/display/CROWD/Crowd+Security+Advisory+2012-05-17 · Vendor Advisory
• http://confluence.atlassian.com/display/BAMBOO/Bamboo+Security+Advisory+2012-05-17 · Vendor Advisory
• http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17 · Vendor Advisory
• http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-05-17 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2926 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2926 · Security Note
• http://confluence.atlassian.com/display/FISHEYE/FishEye+and+Crucible+Security+Advisory+2012-05-17 · Vendor Advisory
• http://secunia.com/advisories/49146 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2926 · Note
• http://securityfocus.com/bid/53595 · Note
• http://osvdb.org/81993 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75682 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75697 · Note