PT-2018-6349 · Atlassian · Crucible+1

David Black · Published 2018-02-01 · Updated 2019-10-03 · CVE-2017-16861

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Fisheye versions prior to 4.4.5 Fisheye versions 4.5.0 through 4.5.1 Crucible versions prior to 4.4.5 Crucible versions 4.5.0 through 4.5.1

Description: The issue allows for double OGNL evaluation in certain redirect actions and in WebWork URL and Anchor tags in JSP files. An attacker with access to the web interface of Fisheye or Crucible, or who hosts a website visited by a user with such access, can exploit this to execute Java code of their choice on systems running a vulnerable version.

Recommendations: For Fisheye versions prior to 4.4.5, update to version 4.4.5 or later. For Fisheye versions 4.5.0 through 4.5.1, update to version 4.5.2 or later. For Crucible versions prior to 4.4.5, update to version 4.4.5 or later. For Crucible versions 4.5.0 through 4.5.1, update to version 4.5.2 or later.

Fix

Related Identifiers

CVE-2017-16861

Affected Products

Crucible

Fisheye

References · 7

• https://jira.atlassian.com/browse/CRUC-8156 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16861 · Security Note
• https://confluence.atlassian.com/x/h-QyO · Vendor Advisory
• https://jira.atlassian.com/browse/FE-6991 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16861 · Vendor Advisory
• https://confluence.atlassian.com/x/iPQyO · Vendor Advisory
• http://securityfocus.com/bid/102971 · Note