We have discovered a vulnerability in WebWork 2, which is a part of the Struts web framework.

      In specific circumstances, attackers can use this vulnerability to execute Java code of their choice on systems that use these frameworks.

      In case of Fisheye, the attacker needs to be able to access Fisheye Web interface. A valid user account is not is required to exploit this vulnerability.

      Customers should be advised that this effects all previously released versions of Fisheye, except Fisheye OnDemand, Fisheye 2.10.6 (or later) and Fisheye 3.0.2 (or later).

      For more information on this issue, please see the security advisory here.

          Form Name

            [FE-4729] Webwork 2 code injection vulnerability

            There are no comments yet on this issue.

              Unassigned Unassigned
              clepetit ChrisA
              Affected customers:
              0 This affects my team
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: