PT-2012-4373 · Atlassian · Jira+1

Published 2012-05-22 · Updated 2017-08-29 · CVE-2012-2927

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Atlassian JIRA TM Software Tempo plugin versions prior to 6.4.3.1 Atlassian JIRA TM Software Tempo plugin versions 6.5.x prior to 6.5.0.2 Atlassian JIRA TM Software Tempo plugin versions 7.x prior to 7.0.3

Description The issue allows remote authenticated users to cause a denial of service due to improper restriction of third-party XML parsers, leading to resource consumption.

Recommendations For versions prior to 6.4.3.1, update to version 6.4.3.1 or later. For versions 6.5.x prior to 6.5.0.2, update to version 6.5.0.2 or later. For versions 7.x prior to 7.0.3, update to version 7.0.3 or later.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2012-2927

Affected Products

Jira

Tempo Plugin

References · 6

• http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17 · Vendor Advisory
• http://secunia.com/advisories/49166 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2927 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75697 · Note
• http://securityfocus.com/bid/53595 · Note
• http://osvdb.org/81993 · Note