CVE-2018-5223: Input Validation
First published: Thu Mar 29 2018(Updated: )
Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible on the Windows operating system. All versions of Fisheye and Crucible before 4.4.6 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.3 (the fixed version for 4.5.x) are affected by this vulnerability.
Credit: security@atlassian.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Atlassian FishEye | >=4.4.0<4.4.6 | |
| Atlassian FishEye | >=4.5.0<4.5.3 | |
| Atlassian Crucible | >=4.4.0<4.4.6 | |
| Atlassian Crucible | >=4.5.0<4.5.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-5223?
The severity of CVE-2018-5223 is high with a severity value of 7.2.
How does CVE-2018-5223 affect Atlassian FishEye and Crucible?
CVE-2018-5223 affects Atlassian FishEye versions 4.4.0 to 4.4.6 and Atlassian Crucible versions 4.4.0 to 4.4.6, as well as Atlassian FishEye versions 4.5.0 to 4.5.3 and Atlassian Crucible versions 4.5.0 to 4.5.3.
What is the vulnerability in CVE-2018-5223?
The vulnerability in CVE-2018-5223 is that Fisheye and Crucible do not correctly check if a configured Mercurial repository URI contains values that the Windows operating system may consider argument parameters, allowing an attacker to execute code of their choice on affected systems.
How can an attacker exploit CVE-2018-5223?
An attacker who has permission to add a repository in Fisheye or Crucible can exploit CVE-2018-5223 to execute code of their choice on systems that run affected versions of the software.
Are there any fixes available for CVE-2018-5223?
Yes, Atlassian has released fixed versions for both FishEye and Crucible to address the vulnerability. It is recommended to upgrade to the latest version available.
- collector/nvd-index
- agent/author
- agent/severity
- agent/weakness
- agent/references
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/remedy
- agent/description
- agent/tags
- agent/type
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/atlassian
- canonical/atlassian fisheye
- version/atlassian fisheye/4.4.0
- version/atlassian fisheye/4.5.0
- canonical/atlassian crucible
- version/atlassian crucible/4.4.0
- version/atlassian crucible/4.5.0