Vulnerability CVE-2015-5603
Published: 2015-09-21

Description:
The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecified vectors, related to "Velocity Template Injection Vulnerability."

See advisories in our WLB2 database:
Topic
Author
Date
High
Jira / HipChat For Jira Java Code Execution
David Black
02.09.2015
Low
JIRA and HipChat for JIRA plugin Velocity Template Injection Vulnerability
Chris Wood
29.10.2015
Med.
Atlassian HipChat for Jira Plugin Velocity Template Injection
sinn3r
05.12.2015

Type:

CWE-94

 (Improper Control of Generation of Code ('Code Injection'))

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.5/10
6.4/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Atlassian -> Hipchat 

 References:
http://packetstormsecurity.com/files/133401/Jira-HipChat-For-Jira-Java-Code-Execution.html
http://www.rapid7.com/db/modules/exploit/multi/http/jira_hipchat_template
http://www.securityfocus.com/archive/1/536374/100/0/threaded
https://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2015-08-26-776650785.html
https://www.exploit-db.com/exploits/38551/
https://www.exploit-db.com/exploits/38905/
Copyright 2024, cxsecurity.com

 

Back to Top