Vulnerability-Lookup

GHSA-7HGH-752M-38MJ

Vulnerability from github – Published: 2022-05-17 00:12 – Updated: 2022-05-17 00:12

Details

A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators. This issue was introduced in version 2.2.0 of Hipchat Server and version 3.0.0 of Hipchat Data Center. Versions of Hipchat Server starting with 2.2.0 and before 2.2.6 are affected by this vulnerability. Versions of Hipchat Data Center starting with 3.0.0 and before 3.1.0 are affected.

Severity

7.2 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2017-14585"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-11-27T16:29:00Z",
    "severity": "HIGH"
  },
  "details": "A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators. This issue was introduced in version 2.2.0 of Hipchat Server and version 3.0.0 of Hipchat Data Center. Versions of Hipchat Server starting with 2.2.0 and before 2.2.6 are affected by this vulnerability. Versions of Hipchat Data Center starting with 3.0.0 and before 3.1.0 are affected.",
  "id": "GHSA-7hgh-752m-38mj",
  "modified": "2022-05-17T00:12:15Z",
  "published": "2022-05-17T00:12:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14585"
    },
    {
      "type": "WEB",
      "url": "https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-11-22-939946293.html"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/HCPUB-3526"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/101945"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2017-14585 (GCVE-0-2017-14585)

Vulnerability from cvelistv5 – Published: 2017-11-27 16:00 – Updated: 2024-09-16 19:31

Summary

Severity

No CVSS data available.

CWE

Remote Code Execution

Assigner

atlassian

References

3 references

URL	Tags
https://jira.atlassian.com/browse/HCPUB-3526	x_refsource_CONFIRM
http://www.securityfocus.com/bid/101945	vdb-entryx_refsource_BID
https://confluence.atlassian.com/hc/hipchat-serve…	x_refsource_CONFIRM

Impacted products

2 products

Vendor	Product	Version
Atlassian	Hipchat Server	Affected: 2.2.0 <= version < 4.3
Atlassian	Hipchat Data Center	Affected: 3.0.0 <= version < 3.1.0

Date Public

2017-11-22 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T19:34:39.232Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://jira.atlassian.com/browse/HCPUB-3526"
          },
          {
            "name": "101945",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/101945"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-11-22-939946293.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Hipchat Server",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "2.2.0 \u003c= version \u003c 4.3"
            }
          ]
        },
        {
          "product": "Hipchat Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0 \u003c= version \u003c 3.1.0"
            }
          ]
        }
      ],
      "datePublic": "2017-11-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators. This issue was introduced in version 2.2.0 of Hipchat Server and version 3.0.0 of Hipchat Data Center. Versions of Hipchat Server starting with 2.2.0 and before 2.2.6 are affected by this vulnerability. Versions of Hipchat Data Center starting with 3.0.0 and before 3.1.0 are affected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-28T10:57:01.000Z",
        "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "shortName": "atlassian"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://jira.atlassian.com/browse/HCPUB-3526"
        },
        {
          "name": "101945",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/101945"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-11-22-939946293.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@atlassian.com",
          "DATE_PUBLIC": "2017-11-22T00:00:00",
          "ID": "CVE-2017-14585",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Hipchat Server",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2.2.0 \u003c= version \u003c 4.3"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Hipchat Data Center",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "3.0.0 \u003c= version \u003c 3.1.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Atlassian"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators. This issue was introduced in version 2.2.0 of Hipchat Server and version 3.0.0 of Hipchat Data Center. Versions of Hipchat Server starting with 2.2.0 and before 2.2.6 are affected by this vulnerability. Versions of Hipchat Data Center starting with 3.0.0 and before 3.1.0 are affected."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Remote Code Execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jira.atlassian.com/browse/HCPUB-3526",
              "refsource": "CONFIRM",
              "url": "https://jira.atlassian.com/browse/HCPUB-3526"
            },
            {
              "name": "101945",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/101945"
            },
            {
              "name": "https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-11-22-939946293.html",
              "refsource": "CONFIRM",
              "url": "https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-11-22-939946293.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
    "assignerShortName": "atlassian",
    "cveId": "CVE-2017-14585",
    "datePublished": "2017-11-27T16:00:00.000Z",
    "dateReserved": "2017-09-19T00:00:00.000Z",
    "dateUpdated": "2024-09-16T19:31:45.090Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-7HGH-752M-38MJ

CVE-2017-14585 (GCVE-0-2017-14585)

Tags

Sightings

Nomenclature