CVE-2017-5983

EPSS 16.2%

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 16.2%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

10 Apr 2017Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object.

Affected products

n/a · n/a

References

http://codewhitesec.blogspot.com/2017/04/amf.html https://confluence.atlassian.com/jira063/jira-security-advisory-2017-03-09-875604401.html https://jira.atlassian.com/browse/JRASERVER-64077 https://www.kb.cert.org/vuls/id/307983 http://www.securityfocus.com/bid/97379