CVE-2012-2928

The Gliffy plugin before 3.7.1 for Atlassian JIRA, and before 4.2 for Atlassian Confluence, does not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:gliffy:gliffy:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:a:gliffy:gliffy:2.1.1:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:3.1.2:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:2.2.2:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:2.2.1:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:3.0.5:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:3.1.4:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:3.5:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:2.2.0:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:3.0.2:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:3.0.4:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:3.5.2:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:3.6:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:2.1.2:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:3.0.3:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:*:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:3.1.3:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:3.6.1:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:2.1.3:*:*:*:*:*:*:*
cpe:2.3:a:gliffy:gliffy:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:4.1.9:*:*:*:*:*:*:*

History

14 May 2022, 03:25

Type Values Removed Values Added
References (BID) http://www.securityfocus.com/bid/53595 - (BID) http://www.securityfocus.com/bid/53595 - Broken Link, Third Party Advisory, VDB Entry
References (CONFIRM) http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17 - (CONFIRM) http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17 - Mitigation, Vendor Advisory
References (OSVDB) http://osvdb.org/81993 - (OSVDB) http://osvdb.org/81993 - Broken Link
References (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/75697 - (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/75697 - Third Party Advisory, VDB Entry
References (CONFIRM) http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-05-17 - Vendor Advisory (CONFIRM) http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-05-17 - Mitigation, Vendor Advisory

13 Dec 2021, 16:01

Type Values Removed Values Added
CPE cpe:2.3:a:atlassian:confluence:4.1.9:*:*:*:*:*:*:* cpe:2.3:a:atlassian:confluence_server:4.1.9:*:*:*:*:*:*:*

Information

Published : 2012-05-22 15:55

Updated : 2022-05-14 03:25


NVD link : CVE-2012-2928

Mitre link : CVE-2012-2928


JSON object : View

Products Affected

atlassian

  • jira
  • confluence_server

gliffy

  • gliffy
CWE
CWE-264

Permissions, Privileges, and Access Controls