Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-16859

The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parameter.

Published

2018-06-28T14:29:00.213

Last Modified

2024-11-21T03:17:06.973

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-22
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application atlassian crucible < 4.3.2 Yes
Application atlassian crucible < 4.4.3 Yes
Application atlassian crucible < 4.5.0 Yes
Application atlassian fisheye < 4.3.2 Yes
Application atlassian fisheye < 4.4.3 Yes
Application atlassian fisheye < 4.5.0 Yes
References