QwikSec

Security Database

CVE

CWE

Training

CVE-2017-16859

Published: Jun 28, 2018

Modified: Sep 16, 2024

PUBLISHED

Description

The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parameter.

Vendor	Product	Versions
Atlassian	Fisheye and Crucible	affected `unspecified - < 4.3.2` affected `4.4.0 - < unspecified` affected `unspecified - < 4.4.3`

References

https://jira.atlassian.com/browse/CRUC-8212

x_refsource_CONFIRM

vdb-entry

x_refsource_BID

https://jira.atlassian.com/browse/FE-7061

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.