CVE-2015-5603

Опубликовано: 21 сент. 2015

Источник: nvd

CVSS2: 6.5

EPSS Высокий

Описание

The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecified vectors, related to "Velocity Template Injection Vulnerability."

Ссылки

http://packetstormsecurity.com/files/133401/Jira-HipChat-For-Jira-Java-Code-Execution.html
http://www.rapid7.com/db/modules/exploit/multi/http/jira_hipchat_template
http://www.securityfocus.com/archive/1/536374/100/0/threaded
https://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2015-08-26-776650785.html
Vendor Advisory
https://www.exploit-db.com/exploits/38551/
https://www.exploit-db.com/exploits/38905/
http://packetstormsecurity.com/files/133401/Jira-HipChat-For-Jira-Java-Code-Execution.html
http://www.rapid7.com/db/modules/exploit/multi/http/jira_hipchat_template
http://www.securityfocus.com/archive/1/536374/100/0/threaded
https://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2015-08-26-776650785.html
Vendor Advisory
https://www.exploit-db.com/exploits/38551/
https://www.exploit-db.com/exploits/38905/

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:atlassian:hipchat:*:*:*:*:*:*:*:*

Версия до 6.29.2 (включая)

EPSS

Процентиль: 99%

0.8253

Высокий

6.5 Medium

CVSS2

Дефекты

CWE-94

Связанные уязвимости

GHSA-2v3r-wf43-c9gh

github

больше 3 лет назад