CVE-2018-5223: Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument…

PriorityP343high7.2CVSS 3.0

AVNACLPRHUINSUCHIHAH

EPSS

2.20%

80.5th percentile

Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible on the Windows operating system. All versions of Fisheye and Crucible before 4.4.6 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.3 (the fixed version for 4.5.x) are affected by this vulnerability.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
atlassian	crucible	>= 4.4.0 < 4.4.6	4.4.6
atlassian	crucible	>= 4.5.0 < 4.5.3	4.5.3
atlassian	fisheye	>= 4.4.0 < 4.4.6	4.4.6
atlassian	fisheye	>= 4.5.0 < 4.5.3	4.5.3
atlassian	fisheye_and_crucible	>= 4.5.0 < unspecified	unspecified
atlassian	fisheye_and_crucible	>= unspecified < 4.4.6	4.4.6
atlassian	fisheye_and_crucible	>= unspecified < 4.5.3	4.5.3

CVSS provenance

nvdv3.07.2HIGHCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.