PT-2017-14438 · Inedo · Buildmaster

Published 2017-11-10 · Updated 2017-11-27 · CVE-2017-16521

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BuildMaster versions prior to 5.8.2

Description The issue arises from the use of XslTransform instead of XslCompiledTransform in Inedo BuildMaster.

Recommendations For versions prior to 5.8.2, update to version 5.8.2 or later to resolve the issue.

Fix

Related Identifiers

CVE-2017-16521

Affected Products

Buildmaster

References · 7

• https://inedo.com/blog/buildmaster-582-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16521 · Security Note
• https://inedo.myjetbrains.com/youtrack/issue/BM-3108 · Vendor Advisory
• https://inedo.com/buildmaster/versions#v5.8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16521 · Vendor Advisory
• https://gitlab.com/inedo/buildmaster/commit/4f4c737fefe44c3227535946f535fb7ef468d721 · Note
• https://inedo.myjetbrains.com/youtrack/issue/EDO-3334 · Note