CVE-2015-5603
50Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 59%
from disclosure to weapon37 days
Published on NVDSep 21
1st PoC+37d
metasploit+37d
exploitation probability
59%top 1% of all CVEs
observed exploitation
nono source reports it
5 public exploit(s)
The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecified vectors, related to "Velocity Template Injection Vulnerability."
Affected products
n/a · n/apublic PoCs found — 5
cve_referencepacketstormsecurity.com/files/133401/Jira-HipChat-For-Jira-Java-Code-Execution.htmlunverifiedcve_referencewww.exploit-db.com/exploits/38551/unverifiedcve_referencewww.exploit-db.com/exploits/38905/unverifiedexploitdbwww.exploit-db.com/exploits/38905unverifiedexploitdbwww.exploit-db.com/exploits/38551unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/133401/Jira-HipChat-For-Jira-Java-Code-Execution.htmlhttps://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2015-08-26-776650785.htmlhttps://www.exploit-db.com/exploits/38551/https://www.exploit-db.com/exploits/38905/http://www.rapid7.com/db/modules/exploit/multi/http/jira_hipchat_templatehttp://www.securityfocus.com/archive/1/536374/100/0/threaded