CVE-2017-14591

Опубликовано: 29 нояб. 2017

Источник: nvd

CVSS3: 9

CVSS2: 9.3

EPSS Низкий

Описание

Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software.

Ссылки

http://www.securityfocus.com/bid/102194
Third Party Advisory
VDB Entry
https://confluence.atlassian.com/x/plcGO
Issue Tracking
Mitigation
Vendor Advisory
http://www.securityfocus.com/bid/102194
Third Party Advisory
VDB Entry
https://confluence.atlassian.com/x/plcGO
Issue Tracking
Mitigation
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*

Версия до 4.4.3 (исключая)

cpe:2.3:a:atlassian:crucible:4.5.0:*:*:*:*:*:*:*

cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*

Версия до 4.4.3 (исключая)

cpe:2.3:a:atlassian:fisheye:4.5.0:*:*:*:*:*:*:*

EPSS

Процентиль: 70%

0.00652

Низкий

9 Critical

CVSS3

9.3 Critical

CVSS2

Дефекты

CWE-88

Связанные уязвимости

GHSA-5w4x-5vvq-236j