CVE-2017-14585

A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators. This issue was introduced in version 2.2.0 of Hipchat Server and version 3.0.0 of Hipchat Data Center. Versions of Hipchat Server starting with 2.2.0 and before 2.2.6 are affected by this vulnerability. Versions of Hipchat Data Center starting with 3.0.0 and before 3.1.0 are affected.

• CWE-918

• http://www.securityfocus.com/bid/101945Third Party Advisory, VDB Entry
• https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-11-22-939946293.htmlVendor Advisory
• https://jira.atlassian.com/browse/HCPUB-3526Issue Tracking, Vendor Advisory
• http://www.securityfocus.com/bid/101945Third Party Advisory, VDB Entry
• https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-11-22-939946293.htmlVendor Advisory
• https://jira.atlassian.com/browse/HCPUB-3526Issue Tracking, Vendor Advisory

Published

Nov 27, 2017

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14579STDU Viewer 1.6.375 allows attackers to execute arbitrary co…
• CVE-2017-1458IBM QRadar Network Security 5.4 is vulnerable to a XML Exter…
• CVE-2017-14580XnView Classic for Windows Version 2.41 allows attackers to …
• CVE-2017-14581The Host Control web service in SAP NetWeaver AS JAVA 7.0 th…7.5
• CVE-2017-14582The Zoho Site24x7 Mobile Network Poller application before 1…
• CVE-2017-14583NetApp Clustered Data ONTAP versions 9.x prior to 9.1P10 and…
• CVE-2017-14586The Hipchat for Mac desktop client is vulnerable to client-s…9.8
• CVE-2017-14587The administration user deletion resource in Atlassian Fishe…
• CVE-2017-14588Various resources in Atlassian Fisheye and Crucible before v…
• CVE-2017-14589It was possible for double OGNL evaluation in FreeMarker tem…
• CVE-2017-1459IBM Security Access Manager Appliance 8.0.0 and 9.0.0 specif…
• CVE-2017-14590Bamboo did not check that the name of a branch in a Mercuria…