CVE-2018-5223: Input Validation
Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible on the Windows operating system. All versions of Fisheye and Crucible before 4.4.6 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.3 (the fixed version for 4.5.x) are affected by this vulnerability.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-5223?
The severity of CVE-2018-5223 is high with a severity value of 7.2.
How does CVE-2018-5223 affect Atlassian FishEye and Crucible?
CVE-2018-5223 affects Atlassian FishEye versions 4.4.0 to 4.4.6 and Atlassian Crucible versions 4.4.0 to 4.4.6, as well as Atlassian FishEye versions 4.5.0 to 4.5.3 and Atlassian Crucible versions 4.5.0 to 4.5.3.
What is the vulnerability in CVE-2018-5223?
The vulnerability in CVE-2018-5223 is that Fisheye and Crucible do not correctly check if a configured Mercurial repository URI contains values that the Windows operating system may consider argument parameters, allowing an attacker to execute code of their choice on affected systems.
How can an attacker exploit CVE-2018-5223?
An attacker who has permission to add a repository in Fisheye or Crucible can exploit CVE-2018-5223 to execute code of their choice on systems that run affected versions of the software.
Are there any fixes available for CVE-2018-5223?
Yes, Atlassian has released fixed versions for both FishEye and Crucible to address the vulnerability. It is recommended to upgrade to the latest version available.