{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-03-09T00:00:00", "descriptions": [{"lang": "en", "value": "The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-04-11T09:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://jira.atlassian.com/browse/JRASERVER-64077"}, {"name": "VU#307983", "tags": ["third-party-advisory", "x_refsource_CERT-VN"], "url": "https://www.kb.cert.org/vuls/id/307983"}, {"name": "97379", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/97379"}, {"tags": ["x_refsource_MISC"], "url": "http://codewhitesec.blogspot.com/2017/04/amf.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://confluence.atlassian.com/jira063/jira-security-advisory-2017-03-09-875604401.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-5983", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://jira.atlassian.com/browse/JRASERVER-64077", "refsource": "CONFIRM", "url": "https://jira.atlassian.com/browse/JRASERVER-64077"}, {"name": "VU#307983", "refsource": "CERT-VN", "url": "https://www.kb.cert.org/vuls/id/307983"}, {"name": "97379", "refsource": "BID", "url": "http://www.securityfocus.com/bid/97379"}, {"name": "http://codewhitesec.blogspot.com/2017/04/amf.html", "refsource": "MISC", "url": "http://codewhitesec.blogspot.com/2017/04/amf.html"}, {"name": "https://confluence.atlassian.com/jira063/jira-security-advisory-2017-03-09-875604401.html", "refsource": "CONFIRM", "url": "https://confluence.atlassian.com/jira063/jira-security-advisory-2017-03-09-875604401.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T15:18:49.331Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://jira.atlassian.com/browse/JRASERVER-64077"}, {"name": "VU#307983", "tags": ["third-party-advisory", "x_refsource_CERT-VN", "x_transferred"], "url": "https://www.kb.cert.org/vuls/id/307983"}, {"name": "97379", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/97379"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://codewhitesec.blogspot.com/2017/04/amf.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://confluence.atlassian.com/jira063/jira-security-advisory-2017-03-09-875604401.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-5983", "datePublished": "2017-04-10T15:00:00", "dateReserved": "2017-02-13T00:00:00", "dateUpdated": "2024-08-05T15:18:49.331Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:jira:4.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "E72FD8F4-B47B-4D45-81BC-281C7C88BF64", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:4.3:*:*:*:*:*:*:*", "matchCriteriaId": "E6392A0B-252B-4BE9-8381-882364CAF93D", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:4.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "5022C4F9-48A7-4995-994A-455F545CDB8F", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:4.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "3A8EC6B1-A57B-4277-B904-CFFC2B1B8630", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:4.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "E1F805A3-631D-4667-BF72-62A3DDDCDB2D", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:4.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "7EDB91B1-7D20-4BCC-A512-6F75EF70BE94", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:4.4:*:*:*:*:*:*:*", "matchCriteriaId": "0B02481E-5E51-423E-A5E7-630EB3DA5F99", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:4.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "A3ED291F-4F1F-48BA-832C-A70B639BBDCD", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:4.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "C402D0FF-E479-480A-BB01-7932CF2BF2E0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:4.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "395E3ED3-3DA5-40A6-B932-36F9BF13FD76", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:4.4.4:*:*:*:*:*:*:*", "matchCriteriaId": "41F1DD46-4FBD-40BC-B276-51C2B239BC4B", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:4.4.5:*:*:*:*:*:*:*", "matchCriteriaId": "82FC7263-D0E3-490A-9DF6-ED89051354A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.0:*:*:*:*:*:*:*", "matchCriteriaId": "6CB09662-5926-4AE5-BF22-B082ED223A46", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "B83D3C97-BA63-44FB-8449-220AA6B31CC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "F7ED8C91-7225-439E-BEC6-BC8E23D86041", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "F181716D-3B1E-493C-A92D-D02E90922EE2", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "3B86AA59-2C88-4113-85B1-0F8404155ED3", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "25DAF540-7BB4-4325-9438-74F9F738519B", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "3D9E7034-3F9E-4CE3-81D0-6EB2E62F0437", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.1:*:*:*:*:*:*:*", "matchCriteriaId": "F3046E68-3839-4B96-83B1-4F14AFFD8DF5", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "65CB7DB0-F3CA-4037-A5FF-5D7F6678B314", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "17A58D60-1085-4E64-8706-8EC8686D4904", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "00339DCD-824D-46FA-9EFD-E4835BC7F52C", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.1.4:*:*:*:*:*:*:*", "matchCriteriaId": "ED7C6417-0212-489D-9324-2C653E32566A", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.1.5:*:*:*:*:*:*:*", "matchCriteriaId": "4C61E4B1-69D4-4278-B404-39293751033F", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.1.6:*:*:*:*:*:*:*", "matchCriteriaId": "A8790F9F-C124-410A-BEE5-241341C5CA57", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.1.7:*:*:*:*:*:*:*", "matchCriteriaId": "C60F705C-ECF9-4F48-BE4C-CCB9E88E018B", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.1.8:*:*:*:*:*:*:*", "matchCriteriaId": "F008971D-88E6-4D60-8755-294FD157FBF2", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.2:*:*:*:*:*:*:*", "matchCriteriaId": "1A224603-11AA-491D-9A06-8D573FEDDC83", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "C5117735-A248-44DD-B2B5-0A1D5CFB4977", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "CA863005-6CD1-4FEC-8A1A-6E62FC76952D", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "417098AA-30D0-4915-ACF8-135F59EB1493", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "693A0FEF-0803-419C-A718-DE80B984BA9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "3C401B65-113B-4046-8D36-7F139D05A4B7", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.2.6:*:*:*:*:*:*:*", "matchCriteriaId": "B5AFE657-35A1-4F22-839C-4E2D89C78DA1", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.2.7:*:*:*:*:*:*:*", "matchCriteriaId": "7605C1DD-D26E-4ACF-8915-A2717079198C", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.2.8:*:*:*:*:*:*:*", "matchCriteriaId": "9720C8C4-36A4-4C8B-BB4B-1D1765C76728", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.2.9:*:*:*:*:*:*:*", "matchCriteriaId": "2B79812D-7367-4D71-8B74-77785FAC9874", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.2.10:*:*:*:*:*:*:*", "matchCriteriaId": "6A45A0EB-99CB-4EE9-BFBB-664D0AE91981", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:5.2.11:*:*:*:*:*:*:*", "matchCriteriaId": "8D006394-43B4-4250-87F5-38A2511BC0AE", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "B83446EB-1A2B-4803-9D2A-DBF37A99C96C", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "F5989726-B934-4FF1-AB54-7DC77AC2C6EF", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "D910A750-B5AB-48F1-9A33-0895901E0522", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "CCBB6BD7-5A95-4A8C-9965-F07A29C85AEF", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "B482A552-EF34-4089-8A64-797D8C9BBE43", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "6F8F311F-B327-4541-BA23-C8CF578861B6", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "9E729C6C-799F-4574-B560-51DB7F58C3AC", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "8717780D-1A19-4EE4-A526-6216EA360596", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.1:*:*:*:*:*:*:*", "matchCriteriaId": "2FC850FE-63C9-4E6D-8B14-C8A2224E3FF0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "E129240D-BCC6-4EEF-820A-CF8EF835FE01", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "BAD25985-0587-4DD8-A6BD-DE610CB01175", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "2E2A1992-5247-4978-856A-4BAF064651F2", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.1.4:*:*:*:*:*:*:*", "matchCriteriaId": "8003B5E4-597A-4914-96D5-14C8DEAE9ED8", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.1.5:*:*:*:*:*:*:*", "matchCriteriaId": "4BAE2AA2-A436-4F86-B775-DD358FA82FCB", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.1.6:*:*:*:*:*:*:*", "matchCriteriaId": "4C182FE8-BA50-4782-8D04-825F57DDC5E9", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.1.7:*:*:*:*:*:*:*", "matchCriteriaId": "243F34D7-287A-419C-B709-74869E55402C", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.1.8:*:*:*:*:*:*:*", "matchCriteriaId": "DE4DE2F6-B3E1-45CA-A1F7-08691FD13FE4", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.1.9:*:*:*:*:*:*:*", "matchCriteriaId": "7AED81FE-B027-4114-9A76-7F6B8A06A6BC", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.2:*:*:*:*:*:*:*", "matchCriteriaId": "807D2B66-FE4F-4C83-A8C9-76F874C746BB", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "E21E5768-4A73-431D-9720-55C120BA0C6D", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "4715D04C-DC1D-42EA-AEB4-29E935DF34D1", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "352372E1-FA78-4D5F-B6B3-CA7F547BD7BC", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "254BC1E2-0E41-46EB-9E13-9BEF69B1D786", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "6E6E7BAD-1781-44FF-A347-64498630A26F", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.2.6:*:*:*:*:*:*:*", "matchCriteriaId": "5B61076B-547D-4878-BDA0-C028820DA37C", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira:6.2.7:*:*:*:*:*:*:*", "matchCriteriaId": "F8617A24-1894-48C7-8B05-0403183179E6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object."}, {"lang": "es", "value": "El complemento de JIRA Workflow Designer en Atlassian JIRA Server en versiones anteriores a 6.3.0 utiliza incorrectamente un analizador y deserializador XML, que permite a atacantes remotos ejecutar c\u00f3digo arbitrario, leer archivos arbitrarios o provocar una denegaci\u00f3n de servicio a trav\u00e9s de un objeto Java serializado."}], "id": "CVE-2017-5983", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-04-10T15:59:00.457", "references": [{"source": "cve@mitre.org", "tags": ["Technical Description"], "url": "http://codewhitesec.blogspot.com/2017/04/amf.html"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/97379"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://confluence.atlassian.com/jira063/jira-security-advisory-2017-03-09-875604401.html"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://jira.atlassian.com/browse/JRASERVER-64077"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "US Government Resource", "VDB Entry"], "url": "https://www.kb.cert.org/vuls/id/307983"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Technical Description"], "url": "http://codewhitesec.blogspot.com/2017/04/amf.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/97379"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://confluence.atlassian.com/jira063/jira-security-advisory-2017-03-09-875604401.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://jira.atlassian.com/browse/JRASERVER-64077"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource", "VDB Entry"], "url": "https://www.kb.cert.org/vuls/id/307983"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}