Unscored severity · published May 22, 2012
CVE-2012-2928
The Gliffy plugin before 3.7.1 for Atlassian JIRA, and before 4.2 for Atlassian Confluence, does not properly restrict the capabilities of third-party XML parsers, which allows…
–
CVSS
3%
EPSS
No
On KEV
Description
The Gliffy plugin before 3.7.1 for Atlassian JIRA, and before 4.2 for Atlassian Confluence, does not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Confluence · Atlassian
4.1.9 · source: NVD
JI
Jira · Atlassian
through 5.0.0 · source: NVD
GL
Gliffy · Gliffy
through 3.7; 1.0.1; 2.0.0; 2.0.1; 2.1.0; 2.1.1; +20 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2928
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2928
Mitigation
http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-05-17
Mitigation
http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17
Broken Link
http://osvdb.org/81993
Vendor Advisory
http://secunia.com/advisories/49166
Broken Link
http://www.securityfocus.com/bid/53595
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/75697
More from Confluence
9.8
CVE-2023-22527
Atlassian Confluence Data Center and Server Template Injection Vulnerability
9.8
CVE-2023-22518
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
9.8
CVE-2023-22515
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
9.8
CVE-2022-26138
Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
9.8
CVE-2022-26134
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability