CVEvulnerability
CVE-2017-5983
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-04-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-502
Description
The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object.
Affected configurations
• atlassian jira 4.2.4
• atlassian jira 4.3
• atlassian jira 4.3.1
• atlassian jira 4.3.2
• atlassian jira 4.3.3
• atlassian jira 4.3.4
• atlassian jira 4.4
• atlassian jira 4.4.1
• atlassian jira 4.4.2
• atlassian jira 4.4.3
• atlassian jira 4.4.4
• atlassian jira 4.4.5
• atlassian jira 5.0
• atlassian jira 5.0.1
• atlassian jira 5.0.2
• atlassian jira 5.0.3
• atlassian jira 5.0.4
• atlassian jira 5.0.5
• atlassian jira 5.0.7
• atlassian jira 5.1
• atlassian jira 5.1.1
• atlassian jira 5.1.2
• atlassian jira 5.1.3
• atlassian jira 5.1.4
• atlassian jira 5.1.5
• atlassian jira 5.1.6
• atlassian jira 5.1.7
• atlassian jira 5.1.8
• atlassian jira 5.2
• atlassian jira 5.2.1
• atlassian jira 5.2.2
• atlassian jira 5.2.3
• atlassian jira 5.2.4
• atlassian jira 5.2.5
• atlassian jira 5.2.6
• atlassian jira 5.2.7
• atlassian jira 5.2.8
• atlassian jira 5.2.9
• atlassian jira 5.2.10
• atlassian jira 5.2.11
• atlassian jira 6.0
• atlassian jira 6.0.1
• atlassian jira 6.0.2
• atlassian jira 6.0.3
• atlassian jira 6.0.4
• atlassian jira 6.0.5
• atlassian jira 6.0.7
• atlassian jira 6.0.8
• atlassian jira 6.1
• atlassian jira 6.1.1
• atlassian jira 6.1.2
• atlassian jira 6.1.3
• atlassian jira 6.1.4
• atlassian jira 6.1.5
• atlassian jira 6.1.6
• atlassian jira 6.1.7
• atlassian jira 6.1.8
• atlassian jira 6.1.9
• atlassian jira 6.2
• atlassian jira 6.2.1
… and 6 more
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- http://codewhitesec.blogspot.com/2017/04/amf.html Technical Description
- http://www.securityfocus.com/bid/97379 Third Party Advisory, VDB Entry
- https://confluence.atlassian.com/jira063/jira-security-advisory-2017-03-09-875604401.html Vendor Advisory
- https://jira.atlassian.com/browse/JRASERVER-64077 Vendor Advisory
- https://www.kb.cert.org/vuls/id/307983 Third Party Advisory, US Government Resource, VDB Entry
- http://codewhitesec.blogspot.com/2017/04/amf.html Technical Description
- http://www.securityfocus.com/bid/97379 Third Party Advisory, VDB Entry
- https://confluence.atlassian.com/jira063/jira-security-advisory-2017-03-09-875604401.html Vendor Advisory
- https://jira.atlassian.com/browse/JRASERVER-64077 Vendor Advisory
- https://www.kb.cert.org/vuls/id/307983 Third Party Advisory, US Government Resource, VDB Entry