CVE-2012-2928 The Gliffy plugin before 3.7.1 for Atlassian JIRA, and before 4.2 for Atlassian Confluence, does not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to rea...
MediumCVSS 6.4
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Gliffy plugin before 3.7.1 for Atlassian JIRA, and before 4.2 for Atlassian Confluence, does not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian jira | <= 5.0.0 | No fix listed |
| gliffy | <= 3.7 | No fix listed |
| gliffy | = 1.0.1 | No fix listed |
| gliffy | = 2.0.0 | No fix listed |
| gliffy | = 2.0.1 | No fix listed |
| gliffy | = 2.1.0 | No fix listed |
| gliffy | = 2.1.1 | No fix listed |
| gliffy | = 2.1.2 | No fix listed |
| gliffy | = 2.1.3 | No fix listed |
| gliffy | = 2.2.0 | No fix listed |
| gliffy | = 2.2.1 | No fix listed |
| gliffy | = 2.2.2 | No fix listed |
| gliffy | = 3.0.0 | No fix listed |
| gliffy | = 3.0.1 | No fix listed |
| gliffy | = 3.0.2 | No fix listed |
| gliffy | = 3.0.3 | No fix listed |
| gliffy | = 3.0.4 | No fix listed |
| gliffy | = 3.0.5 | No fix listed |
| gliffy | = 3.1.0 | No fix listed |
| gliffy | = 3.1.1 | No fix listed |
| gliffy | = 3.1.2 | No fix listed |
| gliffy | = 3.1.3 | No fix listed |
| gliffy | = 3.1.4 | No fix listed |
| gliffy | = 3.5 | No fix listed |
| gliffy | = 3.5.2 | No fix listed |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| gliffy | = 3.6 | No fix listed |
| gliffy | = 3.6.1 | No fix listed |
| atlassian confluence server | = 4.1.9 | No fix listed |
References
- confluence.atlassian.com mitigation vendor-advisory
- confluence.atlassian.com mitigation vendor-advisory
- 81993 broken-link vdb-entry
- 49166 third-party-advisory vendor-advisory
- 53595 broken-link third-party-advisory vdb-entry
- jira-xml-dos(75697) third-party-advisory vdb-entry