CVE-2017-14585

CWE-918 — Server-Side Request Forgery (SSRF)3 documents3 sources
Severity
7.2HIGH
EPSS
1.8%
top 17.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Atlassian Hipchat Data CenterAtlassian Hipchat Server
Timeline
PublishedNov 27
Latest updateMay 17

Description

A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators. This issue was introduced in version 2.2.0 of Hipchat Server and version 3.0.0 of Hipchat Data Center. Versions of Hipchat Server starting with 2.2.0 and before 2.2.6 are affected by this vulnerability. Versions of Hipchat Data Center starting with 3.0.0 and before 3.1.0 are affected.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages4 packages

▶NVDatlassian/hipchat_data_center3.0.0 — 3.1.0
▶CVEListV5atlassian/hipchat_data_center3.0.0 <= version < 3.1.0
▶NVDatlassian/hipchat_server2.2.0 — 2.2.6
▶CVEListV5atlassian/hipchat_server2.2.0 <= version < 4.3

🔴Vulnerability Details

2
GHSA
GHSA-7hgh-752m-38mj: A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators↗2022-05-17
▶
CVEList
CVE-2017-14585: A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators↗2017-11-27
▶
CVE-2017-14585 (HIGH CVSS 7.2) | A Server Side Request Forgery (SSRF | cvebase.io