PT-2012-4374 · Atlassian · Jira Gliffy Plugin+1

Published 2012-05-22 · Updated 2022-05-14 · CVE-2012-2928

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Atlassian JIRA Gliffy plugin versions prior to 3.7.1 Atlassian Confluence Gliffy plugin versions prior to 4.2

Description The issue allows remote attackers to read arbitrary files or cause a denial of service due to improper restriction of third-party XML parsers' capabilities.

Recommendations For Atlassian JIRA Gliffy plugin versions prior to 3.7.1, update to version 3.7.1 or later. For Atlassian Confluence Gliffy plugin versions prior to 4.2, update to version 4.2 or later.

Fix

DoS

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-2928

Affected Products

Confluence Gliffy Plugin

Jira Gliffy Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2012-2928 · Security Note
• http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17 · Vendor Advisory
• http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-05-17 · Vendor Advisory
• http://secunia.com/advisories/49166 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2928 · Note
• http://securityfocus.com/bid/53595 · Note
• http://osvdb.org/81993 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75697 · Note