Deserialization in Atlassian Jira
CVE-2017-5983
The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a craft…
Vulnerability class: Insecure Deserialization
EPSS: 0.043 (89.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Atlassian Jira — versions 4.2.4, 4.3, 4.3.1
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- cve@mitre.org (US Government Resource, x_refsource_CERT-VN, VDB Entry, Third Party Advisory, third-party-advisory)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- cve@mitre.org (Technical Description, x_refsource_MISC)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-5983?
- CVE-2017-5983 is a critical-severity vulnerability in Atlassian Jira, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2017-04-10.
- How severe is CVE-2017-5983?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2017-5983 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.