CVE-2017-14591

Related Files

Fisheye / Crucible 4.4.x / 4.5.x Code Execution

Posted Dec 13, 2017

Authored by Atlassian

Fisheye and Crucible did not check that the name of a file in a Mercurial repository contained argument parameters. An attacker who has permission to add a repository or commit to a mercurial repository tracked by Fisheye or Crucible, can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible. All versions of Fisheye and Crucible before 4.4.3 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.1 (the fixed version for 4.5.x) are affected by this vulnerability.

tags | advisory

advisories | CVE-2017-14591

SHA-256 | 0bd5e815725597c657d0c5a6e093eb6974e09f7a3506b05998f40a13281f58a7

Download | Favorite | View