exploitDog

CVE-2020-36232

Опубликовано: 22 фев. 2021

Источник: nvd

CVSS3: 5

CVSS2: 4

EPSS Низкий

Описание

The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from version 4.3.2.0 before 4.3.2.4, from version 4.4.0 before 4.4.12, and from version 5.0.0 before 5.0.1 allowed unexpected DNS lookups and requests to arbitrary services as it incorrectly obtained application base url information from the executing http request which could be attacker controlled.

Ссылки

https://jira.atlassian.com/browse/JRASERVER-72025
Issue Tracking
Patch
Vendor Advisory
https://jira.atlassian.com/browse/JRASERVER-72025
Issue Tracking
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:atlassian:atlassian-gadgets:*:*:*:*:*:atlassian:*:*

Версия до 4.2.37 (исключая)

cpe:2.3:a:atlassian:atlassian-gadgets:*:*:*:*:*:atlassian:*:*

Версия от 4.3.0 (включая) до 4.3.14 (исключая)

cpe:2.3:a:atlassian:atlassian-gadgets:*:*:*:*:*:atlassian:*:*

Версия от 4.3.2.0 (включая) до 4.3.2.4 (исключая)

cpe:2.3:a:atlassian:atlassian-gadgets:*:*:*:*:*:atlassian:*:*

Версия от 4.4.0 (включая) до 4.4.12 (исключая)

cpe:2.3:a:atlassian:atlassian-gadgets:*:*:*:*:*:atlassian:*:*

Версия от 5.0.0 (включая) до 5.0.1 (исключая)

Одно из

cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*

Версия от 8.5.11 (включая) до 8.13.2 (исключая)

cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*

Версия от 8.13.3 (включая) до 8.14.1 (исключая)

cpe:2.3:a:atlassian:jira_data_center:8.15.0:*:*:*:*:*:*:*

cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*

Версия от 8.5.11 (включая) до 8.13.2 (исключая)

cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*

Версия от 8.13.3 (включая) до 8.14.1 (исключая)

cpe:2.3:a:atlassian:jira_server:8.15.0:*:*:*:*:*:*:*

EPSS

Процентиль: 29%

0.00103

Низкий

5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-918

Связанные уязвимости

GHSA-g46m-x4q2-p642

CVSS3: 5

github

больше 3 лет назад

The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from version 4.3.2.0 before 4.3.2.4, from version 4.4.0 before 4.4.12, and from version 5.0.0 before 5.0.1 allowed unexpected DNS lookups and requests to arbitrary services as it incorrectly obtained application base url information from the executing http request which could be attacker controlled.

EPSS

Процентиль: 29%

0.00103

Низкий

5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-918