{"id":"CVE-2017-16859","state":"PUBLISHED","title":"The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read file","description":"The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parameter.","publishedAt":"2018-06-28T14:00:00.000Z","updatedAt":"2024-09-16T17:15:00.298Z","severity":null,"assigner":"atlassian","products":["Atlassian Fisheye and Crucible"],"affected":[{"vendor":"Atlassian","product":"Fisheye and Crucible","versions":[{"version":"unspecified","status":"affected","lessThan":"4.3.2","versionType":"custom"},{"version":"4.4.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"4.4.3","versionType":"custom"}]}],"references":["https://jira.atlassian.com/browse/CRUC-8212","http://www.securityfocus.com/bid/104578","https://jira.atlassian.com/browse/FE-7061"],"weaknesses":[],"ingestedAt":"2026-10-29T19:43:25.795Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2017/16xxx/CVE-2017-16859.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2017-16859","state":"PUBLISHED","datePublished":"2018-06-28T14:00:00.000Z","dateUpdated":"2024-09-16T17:15:00.298Z","assignerShortName":"atlassian","assignerOrgId":"f08a6ab8-ed46-4c22-8884-d911ccfe3c66","dateReserved":"2017-11-16T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parameter."}],"affected":[{"vendor":"Atlassian","product":"Fisheye and Crucible","versions":[{"version":"unspecified","status":"affected","lessThan":"4.3.2","versionType":"custom"},{"version":"4.4.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"4.4.3","versionType":"custom"}]}],"references":[{"url":"https://jira.atlassian.com/browse/CRUC-8212","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/104578","name":"104578","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://jira.atlassian.com/browse/FE-7061","tags":["x_refsource_CONFIRM"]}],"problemTypes":[{"descriptions":[{"description":"Path Traversal","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"atlassian","dateUpdated":"2018-06-29T09:57:01.000Z","orgId":"f08a6ab8-ed46-4c22-8884-d911ccfe3c66"},"datePublic":"2018-06-28T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@atlassian.com","DATE_PUBLIC":"2018-06-28T00:00:00","ID":"CVE-2017-16859","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Fisheye and Crucible","version":{"version_data":[{"version_affected":"<","version_value":"4.3.2"},{"version_affected":">=","version_value":"4.4.0"},{"version_affected":"<","version_value":"4.4.3"}]}}]},"vendor_name":"Atlassian"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parameter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Path Traversal"}]}]},"references":{"reference_data":[{"name":"https://jira.atlassian.com/browse/CRUC-8212","refsource":"CONFIRM","url":"https://jira.atlassian.com/browse/CRUC-8212"},{"name":"104578","refsource":"BID","url":"http://www.securityfocus.com/bid/104578"},{"name":"https://jira.atlassian.com/browse/FE-7061","refsource":"CONFIRM","url":"https://jira.atlassian.com/browse/FE-7061"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://jira.atlassian.com/browse/CRUC-8212","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/104578","name":"104578","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://jira.atlassian.com/browse/FE-7061","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-05T20:35:21.222Z"}}]}}}