PT-2017-13561 · Atlassian · Hipchat+1

Robbie · Published 2017-11-27 · Updated 2017-12-20 · CVE-2017-14585

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hipchat Server versions 2.2.0 through 2.2.6 Hipchat Data Center versions 3.0.0 through 3.1.0

Description A Server Side Request Forgery (SSRF) issue could lead to remote code execution for authenticated administrators.

Recommendations For Hipchat Server versions 2.2.0 through 2.2.6, update to a version after 2.2.6 to resolve the issue. For Hipchat Data Center versions 3.0.0 through 3.1.0, update to a version after 3.1.0 to resolve the issue.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2017-14585

Affected Products

Hipchat

Ichat Server

References · 5

• https://jira.atlassian.com/browse/HCPUB-3526 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-14585 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14585 · Security Note
• https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-11-22-939946293.html · Vendor Advisory
• http://securityfocus.com/bid/101945 · Note