CVE-2017-14586: The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing

Critical severity · published Nov 27, 2017

CVE-2017-14586

The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing

9.8

CVSS

3.5%

EPSS

On KEV

Description

The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing. Hipchat for Mac desktop clients at or above version 4.0 and before version 4.30 are affected by this vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)3.5% · higher than 89% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Hipchat · Atlassian

4.0 before 4.30 · source: NVD

Affected product

Hipchat

Atlassian

All Hipchat CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2017-14586

CVE.org

https://www.cve.org/CVERecord?id=CVE-2017-14586

Third Party Advisory

http://www.securityfocus.com/bid/101947

Vendor Advisory

https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-11-22-939946293.html

Issue Tracking

https://jira.atlassian.com/browse/HCPUB-3473