[CWD-5070] The administration backup restore resource was vulnerable to XXE - CVE-2017-18110 - Create and track feature requests for Atlassian products.

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Medium
Resolution: Fixed
Affects Version/s: None
Fix Version/s: 3.0.2, 3.1.1
Component/s: None
Labels:
- CVE-2017-18110
- advisory
- advisory-released
- bugbounty
- cvss-medium
- injection
- security
- xxe

Symptom Severity:
Severity 2 - Major
Last commented by user?:
true
Bug Fix Policy:
View Atlassian Server bug fix policy

Description

The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read files from the filesystem via a XXE vulnerability.

Attachments

Activity

People

Assignee:: Unassigned

Reporter:: SecurityB

Participants:: SecurityB

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Due:: 03/May/2018

Created:: 08/Mar/2018 9:25 AM

Updated:: 27/Mar/2019 11:37 PM

Resolved:: 08/Mar/2018 10:03 AM

Last commented:: 1 year, 23 weeks, 6 days ago