CVE-2017-16859: Path Traversal
The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parameter.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2017-16859.
What is the severity of CVE-2017-16859?
The severity of CVE-2017-16859 is medium (6.5).
Which versions of Atlassian Fisheye and Crucible are affected by CVE-2017-16859?
Versions before 4.3.2, versions 4.4.0 to 4.4.3, and versions 4.4.5 to 4.5.0 of Atlassian Fisheye and Crucible are affected by CVE-2017-16859.
How does CVE-2017-16859 allow attackers to read files?
CVE-2017-16859 allows remote attackers to read files contained within the context path of the running application through a path traversal vulnerability in the command parameter.
Are there any references available for CVE-2017-16859?
Yes, you can find references for CVE-2017-16859 at the following links: http://www.securityfocus.com/bid/104578, https://jira.atlassian.com/browse/CRUC-8212, https://jira.atlassian.com/browse/FE-7061.