VulnerabilityModified
CVE-2012-2928
The Gliffy plugin before 3.7.1 for Atlassian JIRA, and before 4.2 for Atlassian Confluence, does not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service…
MEDIUM 6.4EPSS 3.06%
Does this matter?
Lower severity and a low EPSS score (3.06%). Track it; it rarely justifies an emergency change on its own.
Description
The Gliffy plugin before 3.7.1 for Atlassian JIRA, and before 4.2 for Atlassian Confluence, does not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
- CVSS 2.0
- 6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
- EPSS
- 3.06% probability · 87th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- atlassian/jira · gliffy/gliffy · atlassian/confluence server
- Source
- cve@mitre.org
References
- http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-05-17Mitigation, Vendor Advisory
- http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17Mitigation, Vendor Advisory
- http://osvdb.org/81993Broken Link
- http://secunia.com/advisories/49166Vendor Advisory
- http://www.securityfocus.com/bid/53595Broken Link, Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75697Third Party Advisory, VDB Entry
- http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-05-17Mitigation, Vendor Advisory
- http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17Mitigation, Vendor Advisory
- http://osvdb.org/81993Broken Link
- http://secunia.com/advisories/49166Vendor Advisory
- http://www.securityfocus.com/bid/53595Broken Link, Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75697Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.