CVE-2017-14591 Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code...
CriticalCVSS 9.0
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian crucible | < 4.4.3 | 4.4.3 |
| atlassian crucible | = 4.5.0 | No fix listed |
| atlassian fisheye | < 4.4.3 | 4.4.3 |
| atlassian fisheye | = 4.5.0 | No fix listed |
| atlassian Fisheye and Crucible | = Versions less than 4.4.3 OR version 4.5.0 | No fix listed |
References
- 102194 third-party-advisory vdb-entry
- confluence.atlassian.com issue-tracking mitigation vendor-advisory