Lucene search
MitreCVE-2012-2928HistoryMay 22, 2012 - 3:55 p.m.
CVE-2012-2928
2012-05-2215:55:02
CWE-264
mitre
web.nvd.nist.gov
28
2
cve-2012-2928
gliffy
atlassian jira
atlassian confluence
xml parsing
remote code execution
CVSS2
6.4
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
AI Score
7.1
Confidence
Low
EPSS
0.017
Percentile
87.7%
The Gliffy plugin before 3.7.1 for Atlassian JIRA, and before 4.2 for Atlassian Confluence, does not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
Affected configurations
Node
gliffygliffyRange≤3.7
atlassianjiraRange≤5.0.0
Node
gliffygliffyRange≤3.7
ORgliffygliffyMatch1.0.1
ORgliffygliffyMatch2.0.0
ORgliffygliffyMatch2.0.1
ORgliffygliffyMatch2.1.0
ORgliffygliffyMatch2.1.1
ORgliffygliffyMatch2.1.2
ORgliffygliffyMatch2.1.3
ORgliffygliffyMatch2.2.0
ORgliffygliffyMatch2.2.1
ORgliffygliffyMatch2.2.2
ORgliffygliffyMatch3.0.0
ORgliffygliffyMatch3.0.1
ORgliffygliffyMatch3.0.2
ORgliffygliffyMatch3.0.3
ORgliffygliffyMatch3.0.4
ORgliffygliffyMatch3.0.5
ORgliffygliffyMatch3.1.0
ORgliffygliffyMatch3.1.1
ORgliffygliffyMatch3.1.2
ORgliffygliffyMatch3.1.3
ORgliffygliffyMatch3.1.4
ORgliffygliffyMatch3.5
ORgliffygliffyMatch3.5.2
ORgliffygliffyMatch3.6
ORgliffygliffyMatch3.6.1
atlassianconfluence_serverMatch4.1.9
| Vendor | Product | Version | CPE |
|---|---|---|---|
| gliffy | gliffy | * | cpe:2.3:a:gliffy:gliffy:*:*:*:*:*:*:*:* |
| atlassian | jira | * | cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:* |
| gliffy | gliffy | 1.0.1 | cpe:2.3:a:gliffy:gliffy:1.0.1:*:*:*:*:*:*:* |
| gliffy | gliffy | 2.0.0 | cpe:2.3:a:gliffy:gliffy:2.0.0:*:*:*:*:*:*:* |
| gliffy | gliffy | 2.0.1 | cpe:2.3:a:gliffy:gliffy:2.0.1:*:*:*:*:*:*:* |
| gliffy | gliffy | 2.1.0 | cpe:2.3:a:gliffy:gliffy:2.1.0:*:*:*:*:*:*:* |
| gliffy | gliffy | 2.1.1 | cpe:2.3:a:gliffy:gliffy:2.1.1:*:*:*:*:*:*:* |
| gliffy | gliffy | 2.1.2 | cpe:2.3:a:gliffy:gliffy:2.1.2:*:*:*:*:*:*:* |
| gliffy | gliffy | 2.1.3 | cpe:2.3:a:gliffy:gliffy:2.1.3:*:*:*:*:*:*:* |
| gliffy | gliffy | 2.2.0 | cpe:2.3:a:gliffy:gliffy:2.2.0:*:*:*:*:*:*:* |
References
Social References
More
Related
nvd
nvd
CVE-2012-2928
2012-05-22 15:55:02
cvelist
cvelist
CVE-2012-2928
2012-05-22 15:00:00
prion
prion
Code injection
2012-05-22 15:55:00
nessus
nessus
Atlassian JIRA < 5.0.1 XML Parsing DoS
2012-06-01 00:00:00
CVSS2
6.4
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
AI Score
7.1
Confidence
Low
EPSS
0.017
Percentile
87.7%
Related for CVE-2012-2928