VULNERABILITY INTELLIGENCE
CVE-2017-5983
CVSS score9.8 CRITICAL
EPSS probability16.24%
CISA KEVNot currently listed
Published2017-04-10
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object.
Weakness classification
- CWE-502: Deserialization of Untrusted Data
Primary references
- cve@mitre.org — Technical Description
- cve@mitre.org — Third Party Advisory, VDB Entry
- cve@mitre.org — Vendor Advisory
- cve@mitre.org — Vendor Advisory
- cve@mitre.org — Third Party Advisory, US Government Resource, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Technical Description
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource, VDB Entry