PT-2017-13567 · Mercurial+1 · Mercurial+1

Zhang Tianqi · Published 2017-11-29 · Updated 2017-12-20 · CVE-2017-14591

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Critical

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Atlassian Fisheye and Crucible versions less than 4.4.3 Atlassian Fisheye and Crucible version 4.5.0

Description The issue allows for argument injection through filenames in Mercurial repositories, enabling attackers to execute arbitrary code on a system running the impacted software.

Recommendations For versions less than 4.4.3, update to version 4.4.3 or later. For version 4.5.0, update to a version later than 4.5.0.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2017-14591

Affected Products

Fisheye/Crucible

Mercurial

References · 4

• https://confluence.atlassian.com/x/plcGO · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-14591 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14591 · Security Note
• http://securityfocus.com/bid/102194 · Note