CVE-2017-14591
CriticalSummary
Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software.
Risk Assessment
Exploitation of this vulnerability could lead to system compromise, posing a significant security risk to the organization.
Recommendation
It is recommended to upgrade Fisheye and Crucible to version 4.4.3 or later to mitigate this vulnerability.
Other vulnerabilities in Atlassian Fisheye and Crucible
See all- CVE-2017-9511High
The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1, allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating system.
- CVE-2017-9512High
The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible before version 4.4.1 allows anonymous remote attackers to access sensitive information, such as email addresses of committers, due to lack of permission checks.
Original NVD description (English source)
Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software.