[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Hipchat Remote Code Execution Vulnerability

Author
Matthew Hart
Risk
[
Security Risk Critical
]
0day-ID
0day-ID-27602
Category
remote exploits
Date add
14-04-2017
CVE
CVE-2017-7357
Platform
multiple
CVE ID:

* CVE-2017-7357.


Product: Hipchat Server.

Affected Hipchat Server product versions:
All versions < 2.2.3


Fixed Hipchat Server product versions:
2.2.3



Summary:
This advisory discloses a critical severity security vulnerability
that was introduced in version 1.0 of Hipchat Server. Versions of
Hipchat Server starting with versions of Hipchat Server from 1.0 but
less than 2.2.3 (the fixed version), are affected by this
vulnerability. are affected by this vulnerability.

HipChat Cloud instances aren't affected by the issue described in this email.

Customers who have upgraded Hipchat Server to version 2.2.3 are not affected.

Customers who have downloaded and installed any version less than
2.2.3 please upgrade your Hipchat Server installations immediately to
fix this vulnerability.


Remote Code Execution via Administrative Imports (CVE-2017-7357)

Severity:
Atlassian rates the severity level of this vulnerability as critical,
according to the scale published in our Atlassian severity levels. The
scale allows us to rank the severity as critical, high, moderate or
low.
This is an independent assessment and you should evaluate its
applicability to your own IT environment.


Description:

An attacker with Server Administrator level privileges could gain
Remote Code Execution via a malicious file importation.
All versions of Hipchat Server starting with versions of Hipchat
Server from 1.0 but less than 2.2.3 (the fixed version), are affected
by this vulnerability. are affected by this vulnerability. are
affected by this vulnerability. This issue can be tracked at:
https://jira.atlassian.com/browse/HCPUB-2903 .


Fix:

To address this issue, we've released the following versions containing a fix:

* Hipchat Server version 2.2.3

Remediation:

Upgrade Hipchat Server to version 2.2.3 or higher.

The vulnerabilities and fix versions are described above. If affected,
you should upgrade to the latest version immediately.




For a full description of the latest version of Hipchat Server, see
the release notes found at
https://confluence.atlassian.com/display/hc/hipchat+server+Release+Notes.
You can download the latest version of Hipchat Server from the
download centre found at https://www.hipchat.com/server/get-it.

#  0day.today [2024-06-16]  #