Deserialization in Atlassian Jira
CVE-2017-5983
The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object.
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.162 (96.9th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 96.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.075 · newest: 0.162 · change: +0.088
Affected products
- Atlassian Jira — versions 4.2.4, 4.3, 4.3.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- jira.atlassian.com/browse/JRASERVER-64077 (Vendor Advisory)
- www.kb.cert.org/vuls/id/307983 (US Government Resource, VDB Entry, Third Party Advisory, third-party-advisory)
- www.securityfocus.com/bid/97379 (VDB Entry, Third Party Advisory, vdb-entry)
- codewhitesec.blogspot.com/2017/04/amf.html (Technical Description)
- confluence.atlassian.com/jira063/jira-security-advisory-2017-03-09-875604401.ht… (Vendor Advisory)
Frequently asked questions
- What is CVE-2017-5983?
- CVE-2017-5983 is a critical-severity vulnerability in Atlassian Jira, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2017-04-10.
- How severe is CVE-2017-5983?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2017-5983 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.