Lucene search

AtlassianCVE-2017-16859

HistoryJun 28, 2018 - 2:29 p.m.

CVE-2017-16859

2018-06-2814:29:00

CWE-22

atlassian

web.nvd.nist.gov

atlassian

fisheye

crucible

cve-2017-16859

path traversal vulnerability

security

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

48.8%

JSON

The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parameter.

Affected configurations

Nvd

Node

atlassiancrucibleRange<4.3.2

atlassiancrucibleRange4.4.0–4.4.3

atlassiancrucibleRange4.4.5–4.5.0

Node

atlassianfisheyeRange<4.3.2

atlassianfisheyeRange4.4.0–4.4.3

atlassianfisheyeRange4.4.5–4.5.0

VendorProductVersionCPE
atlassiancrucible*cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*
atlassianfisheye*cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
atlassian	crucible	*	cpe:2.3:a:atlassian:crucible::::::::
atlassian	fisheye	*	cpe:2.3:a:atlassian:fisheye::::::::

CNA Affected

[
  {
    "product": "Fisheye and Crucible",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "4.3.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "4.4.0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.4.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/104578

jira.atlassian.com/browse/CRUC-8212

jira.atlassian.com/browse/FE-7061

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

48.8%

JSON

Related for CVE-2017-16859