atlassian data-center CVE-2017-18113 vulnerability in Atlassian Products
Published on August 2, 2021

product logo product logo
The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrary code via a Remote Code Execution (RCE) vulnerability. The vulnerability allowed for various problematic OSWorkflow classes to be used as part of workflows. The fix for this issue blocks usage of unsafe conditions, validators, functions and registers that are build-in into OSWorkflow library and other Jira dependencies. Atlassian-made functions or functions provided by 3rd party plugins are not affected by this fix.

NVD

Vulnerability Analysis

CVE-2017-18113 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is a Code Injection Vulnerability?

The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

CVE-2017-18113 has been classified to as a Code Injection vulnerability or weakness.


Products Associated with CVE-2017-18113

stack.watch emails you whenever new vulnerabilities are published in Atlassian Data Center or Atlassian Jira. Just hit a watch button to start following.

Atlassian Data Center
 
Atlassian Jira
 

Affected Versions

Atlassian Jira Server: Atlassian Jira Data Center: atlassian jira_server: atlassian jira_data_center:

Exploit Probability

EPSS
2.57%
Percentile
85.46%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.