Vulnerabilities > CVE-2017-16861 - Unspecified vulnerability in Atlassian Fisheye

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

atlassian

critical

NVD

Published: 2018-02-01

Updated: 2019-10-03

Summary

It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fisheye or Crucible or who hosts a website that a user who can access the web interface of Fisheye or Crucible visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Fisheye or Crucible. All versions of Fisheye and Crucible before 4.4.5 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.2 (the fixed version for 4.5.x) are affected by this vulnerability.

Vulnerable Configurations

Part	Description	Count
Application	Atlassian Atlassian Fisheye 4.5.0 Atlassian Fisheye 4.5.1 Atlassian Fisheye 1.2.5 Atlassian Fisheye 1.3 Atlassian Fisheye 1.3.1 Atlassian Fisheye 1.3.2 Atlassian Fisheye 1.3.3 Atlassian Fisheye 1.3.4 Atlassian Fisheye 1.3.5 Atlassian Fisheye 1.3.6 Atlassian Fisheye 1.3.7 Atlassian Fisheye 1.3.8 Atlassian Fisheye 1.4 Atlassian Fisheye 1.4.1 Atlassian Fisheye 1.4.2 Atlassian Fisheye 1.4.3 Atlassian Fisheye 1.5.0 Atlassian Fisheye 1.5.1 Atlassian Fisheye 1.5.2 Atlassian Fisheye 1.5.3 Atlassian Fisheye 1.5.4 Atlassian Fisheye 1.6.0 Atlassian Fisheye 1.6.1 Atlassian Fisheye 1.6.2 Atlassian Fisheye 1.6.3 Atlassian Fisheye 1.6.4 Atlassian Fisheye 1.6.5.A Atlassian Fisheye 1.6.6 Atlassian Fisheye 2.0 Atlassian Fisheye 2.0.1 Atlassian Fisheye 2.0.2 Atlassian Fisheye 2.0.3 Atlassian Fisheye 2.0.4 Atlassian Fisheye 2.0.5 Atlassian Fisheye 2.0.6 Atlassian Fisheye 2.1.0 Atlassian Fisheye 2.1.1 Atlassian Fisheye 2.1.2 Atlassian Fisheye 2.1.3 Atlassian Fisheye 2.1.4 Atlassian Fisheye 2.2.0 Atlassian Fisheye 2.2.1 Atlassian Fisheye 2.2.3 Atlassian Fisheye 2.3.0 Atlassian Fisheye 2.3.1 Atlassian Fisheye 2.3.2 Atlassian Fisheye 2.3.3 Atlassian Fisheye 2.3.4 Atlassian Fisheye 2.3.5 Atlassian Fisheye 2.3.6 Atlassian Fisheye 2.3.7 Atlassian Fisheye 2.3.8 Atlassian Fisheye 2.4.0 Atlassian Fisheye 2.4.1 Atlassian Fisheye 2.4.2 Atlassian Fisheye 2.4.3 Atlassian Fisheye 2.4.4 Atlassian Fisheye 2.4.5 Atlassian Fisheye 2.4.6 Atlassian Fisheye 2.5.0 Atlassian Fisheye 2.5.1 Atlassian Fisheye 2.5.2 Atlassian Fisheye 2.5.3 Atlassian Fisheye 2.5.4 Atlassian Fisheye 2.5.5 Atlassian Fisheye 2.5.6 Atlassian Fisheye 2.5.7 Atlassian Fisheye 2.5.8 Atlassian Fisheye 2.6.0 Atlassian Fisheye 2.6.1 Atlassian Fisheye 2.6.2 Atlassian Fisheye 2.6.3 Atlassian Fisheye 2.6.4 Atlassian Fisheye 2.6.5 Atlassian Fisheye 2.6.6 Atlassian Fisheye 2.6.7 Atlassian Fisheye 2.6.8 Atlassian Fisheye 2.7.0 Atlassian Fisheye 2.7.1 Atlassian Fisheye 2.7.2 Atlassian Fisheye 2.7.3 Atlassian Fisheye 2.7.4 Atlassian Fisheye 2.7.5 Atlassian Fisheye 2.7.6 Atlassian Fisheye 2.7.7 Atlassian Fisheye 2.7.8 Atlassian Fisheye 2.7.9 Atlassian Fisheye 2.7.10 Atlassian Fisheye 2.7.11 Atlassian Fisheye 2.7.12 Atlassian Fisheye 2.7.13 Atlassian Fisheye 2.7.14 Atlassian Fisheye 2.7.15 Atlassian Fisheye 2.8.0 Atlassian Fisheye 2.8.1 Atlassian Fisheye 2.8.2 Atlassian Fisheye 2.9.0 Atlassian Fisheye 2.9.1 Atlassian Fisheye 2.9.2 Atlassian Fisheye 2.10.0 Atlassian Fisheye 2.10.1 Atlassian Fisheye 2.10.2 Atlassian Fisheye 2.10.3 Atlassian Fisheye 2.10.4 Atlassian Fisheye 2.10.6 Atlassian Fisheye 2.10.7 Atlassian Fisheye 2.10.8 Atlassian Fisheye 3.0.0 Atlassian Fisheye 3.0.1 Atlassian Fisheye 3.0.2 Atlassian Fisheye 3.0.3 Atlassian Fisheye 3.0.4 Atlassian Fisheye 3.1.0 Atlassian Fisheye 3.1.1 Atlassian Fisheye 3.1.2 Atlassian Fisheye 3.1.3 Atlassian Fisheye 3.1.4 Atlassian Fisheye 3.1.5 Atlassian Fisheye 3.1.6 Atlassian Fisheye 3.1.7 Atlassian Fisheye 3.2.0 Atlassian Fisheye 3.2.1 Atlassian Fisheye 3.2.2 Atlassian Fisheye 3.2.3 Atlassian Fisheye 3.2.4 Atlassian Fisheye 3.2.5 Atlassian Fisheye 3.3.0 Atlassian Fisheye 3.3.1 Atlassian Fisheye 3.3.2 Atlassian Fisheye 3.3.3 Atlassian Fisheye 3.3.4 Atlassian Fisheye 3.4.0 Atlassian Fisheye 3.4.1 Atlassian Fisheye 3.4.2 Atlassian Fisheye 3.4.3 Atlassian Fisheye 3.4.4 Atlassian Fisheye 3.4.5 Atlassian Fisheye 3.4.6 Atlassian Fisheye 3.4.7 Atlassian Fisheye 3.5.0 Atlassian Fisheye 3.5.1 Atlassian Fisheye 3.5.2 Atlassian Fisheye 3.5.3 Atlassian Fisheye 3.5.4 Atlassian Fisheye 3.5.5 Atlassian Fisheye 3.6.0 Atlassian Fisheye 3.6.1 Atlassian Fisheye 3.6.2 Atlassian Fisheye 3.6.3 Atlassian Fisheye 3.6.4 Atlassian Fisheye 3.7.0 Atlassian Fisheye 3.7.1 Atlassian Fisheye 3.8.0 Atlassian Fisheye 3.8.1 Atlassian Fisheye 3.9.0 Atlassian Fisheye 3.9.1 Atlassian Fisheye 3.9.2 Atlassian Fisheye 3.10.0 Atlassian Fisheye 3.10.1 Atlassian Fisheye 3.10.2 Atlassian Fisheye 3.10.3 Atlassian Fisheye 3.10.4 Atlassian Fisheye 4.0.0 Atlassian Fisheye 4.0.1 Atlassian Fisheye 4.0.2 Atlassian Fisheye 4.0.3 Atlassian Fisheye 4.0.4 Atlassian Fisheye 4.1.0 Atlassian Fisheye 4.1.1 Atlassian Fisheye 4.1.2 Atlassian Fisheye 4.1.3 Atlassian Fisheye 4.2.0 Atlassian Fisheye 4.2.1 Atlassian Fisheye 4.2.2 Atlassian Fisheye 4.3.0 Atlassian Fisheye 4.3.1 Atlassian Fisheye 4.3.2 Atlassian Fisheye 4.3.3 Atlassian Fisheye 4.4.0 Atlassian Fisheye 4.4.1 Atlassian Fisheye 4.4.2 Atlassian Fisheye 4.4.3 Atlassian Fisheye 4.4.4 Atlassian Crucible 1.1 Atlassian Crucible 1.1.1 Atlassian Crucible 1.1.2 Atlassian Crucible 1.1.3 Atlassian Crucible 1.1.4 Atlassian Crucible 1.2 Atlassian Crucible 1.2.1 Atlassian Crucible 1.2.2 Atlassian Crucible 1.2.3 Atlassian Crucible 1.5.0 Atlassian Crucible 1.5.1 Atlassian Crucible 1.5.2 Atlassian Crucible 1.5.3 Atlassian Crucible 1.5.4 Atlassian Crucible 1.6.0 Atlassian Crucible 1.6.1 Atlassian Crucible 1.6.2 Atlassian Crucible 1.6.2.1 Atlassian Crucible 1.6.3 Atlassian Crucible 1.6.4 Atlassian Crucible 1.6.5.A Atlassian Crucible 1.6.6 Atlassian Crucible 2.0 Atlassian Crucible 2.0.1 Atlassian Crucible 2.0.2 Atlassian Crucible 2.0.3 Atlassian Crucible 2.0.4 Atlassian Crucible 2.0.5 Atlassian Crucible 2.0.6 Atlassian Crucible 2.1.0 Atlassian Crucible 2.1.1 Atlassian Crucible 2.1.2 Atlassian Crucible 2.1.3 Atlassian Crucible 2.1.4 Atlassian Crucible 2.2.0 Atlassian Crucible 2.2.1 Atlassian Crucible 2.2.3 Atlassian Crucible 2.3.0 Atlassian Crucible 2.3.1 Atlassian Crucible 2.3.2 Atlassian Crucible 2.3.3 Atlassian Crucible 2.3.4 Atlassian Crucible 2.3.5 Atlassian Crucible 2.3.6 Atlassian Crucible 2.3.7 Atlassian Crucible 2.3.8 Atlassian Crucible 2.4.0 Atlassian Crucible 2.4.1 Atlassian Crucible 2.4.2 Atlassian Crucible 2.4.3 Atlassian Crucible 2.4.4 Atlassian Crucible 2.4.5 Atlassian Crucible 2.4.6 Atlassian Crucible 2.5.0 Atlassian Crucible 2.5.1 Atlassian Crucible 2.5.2 Atlassian Crucible 2.5.3 Atlassian Crucible 2.5.4 Atlassian Crucible 2.5.5 Atlassian Crucible 2.5.6 Atlassian Crucible 2.5.7 Atlassian Crucible 2.5.8 Atlassian Crucible 2.6.0 Atlassian Crucible 2.6.1 Atlassian Crucible 2.6.2 Atlassian Crucible 2.6.3 Atlassian Crucible 2.6.4 Atlassian Crucible 2.6.5 Atlassian Crucible 2.6.6 Atlassian Crucible 2.6.7 Atlassian Crucible 2.6.8 Atlassian Crucible 2.7.0 Atlassian Crucible 2.7.1 Atlassian Crucible 2.7.2 Atlassian Crucible 2.7.3 Atlassian Crucible 2.7.4 Atlassian Crucible 2.7.5 Atlassian Crucible 2.7.6 Atlassian Crucible 2.7.7 Atlassian Crucible 2.7.8 Atlassian Crucible 2.7.9 Atlassian Crucible 2.7.10 Atlassian Crucible 2.7.11 Atlassian Crucible 2.7.12 Atlassian Crucible 2.7.13 Atlassian Crucible 2.7.14 Atlassian Crucible 2.7.15 Atlassian Crucible 2.8.0 Atlassian Crucible 2.8.1 Atlassian Crucible 2.8.2 Atlassian Crucible 2.9.0 Atlassian Crucible 2.9.1 Atlassian Crucible 2.9.2 Atlassian Crucible 2.10.0 Atlassian Crucible 2.10.1 Atlassian Crucible 2.10.2 Atlassian Crucible 2.10.3 Atlassian Crucible 2.10.4 Atlassian Crucible 2.10.6 Atlassian Crucible 2.10.7 Atlassian Crucible 2.10.8 Atlassian Crucible 3.0.0 Atlassian Crucible 3.0.1 Atlassian Crucible 3.0.2 Atlassian Crucible 3.0.3 Atlassian Crucible 3.0.4 Atlassian Crucible 3.1.0 Atlassian Crucible 3.1.1 Atlassian Crucible 3.1.2 Atlassian Crucible 3.1.3 Atlassian Crucible 3.1.4 Atlassian Crucible 3.1.5 Atlassian Crucible 3.1.6 Atlassian Crucible 3.1.7 Atlassian Crucible 3.2.0 Atlassian Crucible 3.2.1 Atlassian Crucible 3.2.2 Atlassian Crucible 3.2.3 Atlassian Crucible 3.2.4 Atlassian Crucible 3.2.5 Atlassian Crucible 3.3.0 Atlassian Crucible 3.3.1 Atlassian Crucible 3.3.2 Atlassian Crucible 3.3.3 Atlassian Crucible 3.3.4 Atlassian Crucible 3.4.0 Atlassian Crucible 3.4.1 Atlassian Crucible 3.4.2 Atlassian Crucible 3.4.3 Atlassian Crucible 3.4.4 Atlassian Crucible 3.4.5 Atlassian Crucible 3.4.6 Atlassian Crucible 3.4.7 Atlassian Crucible 3.5.0 Atlassian Crucible 3.5.1 Atlassian Crucible 3.5.2 Atlassian Crucible 3.5.3 Atlassian Crucible 3.5.4 Atlassian Crucible 3.5.5 Atlassian Crucible 3.6.0 Atlassian Crucible 3.6.1 Atlassian Crucible 3.6.2 Atlassian Crucible 3.6.3 Atlassian Crucible 3.6.4 Atlassian Crucible 3.7.0 Atlassian Crucible 3.7.1 Atlassian Crucible 3.8.0 Atlassian Crucible 3.8.1 Atlassian Crucible 3.9.0 Atlassian Crucible 3.9.1 Atlassian Crucible 3.9.2 Atlassian Crucible 3.10.0 Atlassian Crucible 3.10.1 Atlassian Crucible 3.10.2 Atlassian Crucible 3.10.3 Atlassian Crucible 3.10.4 Atlassian Crucible 4.0.0 Atlassian Crucible 4.0.1 Atlassian Crucible 4.0.2 Atlassian Crucible 4.0.3 Atlassian Crucible 4.0.4 Atlassian Crucible 4.1.0 Atlassian Crucible 4.1.1 Atlassian Crucible 4.1.2 Atlassian Crucible 4.1.3 Atlassian Crucible 4.2.0 Atlassian Crucible 4.2.1 Atlassian Crucible 4.2.2 Atlassian Crucible 4.2.3 Atlassian Crucible 4.3.0 Atlassian Crucible 4.3.1 Atlassian Crucible 4.3.2 Atlassian Crucible 4.3.3 Atlassian Crucible 4.4.0 Atlassian Crucible 4.4.1 Atlassian Crucible 4.4.2 Atlassian Crucible 4.4.3 Atlassian Crucible 4.4.4 Atlassian Crucible 4.5.0 Atlassian Crucible 4.5.1	373

Summary

Vulnerable Configurations

References