CVE-2017-5983

EPSS 16.2%

Vexday Risk Score

23Baixo

Decisão SSVC (CISA)

Attend

PoC disponível → acompanhar de perto

Maturidade do exploit

Exploit funcional

Exploit automatizável disponível (Nuclei/Metasploit).

CVSS —EPSS 16.2%KEV nãoPoC —Nuclei simMetasploit —Patch —

Ciclo de vida

10 abr 2017Publicada no NVD

Recomendação: Planejar correção próxima — já existe PoC pública.

The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object.

Produtos afetados

n/a · n/a

Referências

http://codewhitesec.blogspot.com/2017/04/amf.html https://confluence.atlassian.com/jira063/jira-security-advisory-2017-03-09-875604401.html https://jira.atlassian.com/browse/JRASERVER-64077 https://www.kb.cert.org/vuls/id/307983 http://www.securityfocus.com/bid/97379