CVE-2017-14591
Last modified
CVE-2017-14591 is a vulnerability of currently unknown severity. Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software.. EPSS estimates a 2.31% chance of exploitation in the next 30 days.
Description
Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Crucible | < 4.4.3 |
| Atlassian | Crucible | 4.5.0 |
| Atlassian | Fisheye | < 4.4.3 |
| Atlassian | Fisheye | 4.5.0 |
References
- http://www.securityfocus.com/bid/102194Third Party Advisory, VDB Entry
- https://confluence.atlassian.com/x/plcGOIssue Tracking, Mitigation, Vendor Advisory
- http://www.securityfocus.com/bid/102194Third Party Advisory, VDB Entry
- https://confluence.atlassian.com/x/plcGOIssue Tracking, Mitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-14591?
How severe is CVE-2017-14591?
How do I fix CVE-2017-14591?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-14586The Hipchat for Mac desktop client is vulnerable to client-s…9.8
- CVE-2017-14587The administration user deletion resource in Atlassian Fishe…
- CVE-2017-14588Various resources in Atlassian Fisheye and Crucible before v…
- CVE-2017-14589It was possible for double OGNL evaluation in FreeMarker tem…
- CVE-2017-1459IBM Security Access Manager Appliance 8.0.0 and 9.0.0 specif…
- CVE-2017-14590Bamboo did not check that the name of a branch in a Mercuria…
- CVE-2017-14592Sourcetree for macOS had several argument and command inject…
- CVE-2017-14593Sourcetree for Windows had several argument and command inje…
- CVE-2017-14594The printable searchrequest issue resource in Atlassian Jira…
- CVE-2017-14595In Joomla! before 3.8.0, a logic bug in a SQL query could le…
- CVE-2017-14596In Joomla! before 3.8.0, inadequate escaping in the LDAP aut…
- CVE-2017-14597AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XS…
Are you affected by CVE-2017-14591?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST