| Package | Affected versions | Patched versions |
|---|---|---|
| confluence server | = 4.1.9 | |
| jira | ≤ 5.0.0 | |
| gliffy | = 1.0.1= 2.0.0= 2.0.1= 2.1.0= 2.1.1= 2.1.2= 2.1.3= 2.2.0= 2.2.1= 2.2.2= 3.0.0= 3.0.1= 3.0.2= 3.0.3= 3.0.4= 3.0.5= 3.1.0= 3.1.1= 3.1.2= 3.1.3= 3.1.4= 3.5= 3.5.2= 3.6= 3.6.1≤ 3.7 |
The Gliffy plugin before 3.7.1 for Atlassian JIRA, and before 4.2 for Atlassian Confluence, does not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free