CVE-2017-5983 The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, o...
CriticalCVSS 9.8
EPSS 16.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian jira | = 4.2.4 | No fix listed |
| atlassian jira | = 4.3 | No fix listed |
| atlassian jira | = 4.3.1 | No fix listed |
| atlassian jira | = 4.3.2 | No fix listed |
| atlassian jira | = 4.3.3 | No fix listed |
| atlassian jira | = 4.3.4 | No fix listed |
| atlassian jira | = 4.4 | No fix listed |
| atlassian jira | = 4.4.1 | No fix listed |
| atlassian jira | = 4.4.2 | No fix listed |
| atlassian jira | = 4.4.3 | No fix listed |
| atlassian jira | = 4.4.4 | No fix listed |
| atlassian jira | = 4.4.5 | No fix listed |
| atlassian jira | = 5.0 | No fix listed |
| atlassian jira | = 5.0.1 | No fix listed |
| atlassian jira | = 5.0.2 | No fix listed |
| atlassian jira | = 5.0.3 | No fix listed |
| atlassian jira | = 5.0.4 | No fix listed |
| atlassian jira | = 5.0.5 | No fix listed |
| atlassian jira | = 5.0.7 | No fix listed |
| atlassian jira | = 5.1 | No fix listed |
| atlassian jira | = 5.1.1 | No fix listed |
| atlassian jira | = 5.1.2 | No fix listed |
| atlassian jira | = 5.1.3 | No fix listed |
| atlassian jira | = 5.1.4 | No fix listed |
| atlassian jira | = 5.1.5 | No fix listed |
Show 41 more
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian jira | = 5.1.6 | No fix listed |
| atlassian jira | = 5.1.7 | No fix listed |
| atlassian jira | = 5.1.8 | No fix listed |
| atlassian jira | = 5.2 | No fix listed |
| atlassian jira | = 5.2.1 | No fix listed |
| atlassian jira | = 5.2.2 | No fix listed |
| atlassian jira | = 5.2.3 | No fix listed |
| atlassian jira | = 5.2.4 | No fix listed |
| atlassian jira | = 5.2.5 | No fix listed |
| atlassian jira | = 5.2.6 | No fix listed |
| atlassian jira | = 5.2.7 | No fix listed |
| atlassian jira | = 5.2.8 | No fix listed |
| atlassian jira | = 5.2.9 | No fix listed |
| atlassian jira | = 5.2.10 | No fix listed |
| atlassian jira | = 5.2.11 | No fix listed |
| atlassian jira | = 6.0 | No fix listed |
| atlassian jira | = 6.0.1 | No fix listed |
| atlassian jira | = 6.0.2 | No fix listed |
| atlassian jira | = 6.0.3 | No fix listed |
| atlassian jira | = 6.0.4 | No fix listed |
| atlassian jira | = 6.0.5 | No fix listed |
| atlassian jira | = 6.0.7 | No fix listed |
| atlassian jira | = 6.0.8 | No fix listed |
| atlassian jira | = 6.1 | No fix listed |
| atlassian jira | = 6.1.1 | No fix listed |
| atlassian jira | = 6.1.2 | No fix listed |
| atlassian jira | = 6.1.3 | No fix listed |
| atlassian jira | = 6.1.4 | No fix listed |
| atlassian jira | = 6.1.5 | No fix listed |
| atlassian jira | = 6.1.6 | No fix listed |
| atlassian jira | = 6.1.7 | No fix listed |
| atlassian jira | = 6.1.8 | No fix listed |
| atlassian jira | = 6.1.9 | No fix listed |
| atlassian jira | = 6.2 | No fix listed |
| atlassian jira | = 6.2.1 | No fix listed |
| atlassian jira | = 6.2.2 | No fix listed |
| atlassian jira | = 6.2.3 | No fix listed |
| atlassian jira | = 6.2.4 | No fix listed |
| atlassian jira | = 6.2.5 | No fix listed |
| atlassian jira | = 6.2.6 | No fix listed |
| atlassian jira | = 6.2.7 | No fix listed |
References
- codewhitesec.blogspot.com technical-description
- 97379 third-party-advisory vdb-entry
- confluence.atlassian.com vendor-advisory
- jira.atlassian.com vendor-advisory
- VU#307983 third-party-advisory us-government-resource vdb-entry