CVE-2017-14585

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators. This issue was introduced in version 2.2.0 of Hipchat Server and version 3.0.0 of Hipchat Data Center. Versions of Hipchat Server starting with 2.2.0 and before 2.2.6 are affected by this vulnerability. Versions of Hipchat Data Center starting with 3.0.0 and before 3.1.0 are affected.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Nov 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-145869.8The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing. Hipchat for Mac desktop c CVE-2017-145875.4The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary CVE-2017-145886.1Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a CVE-2017-145899.6It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted a CVE-2017-14594.2IBM Security Access Manager Appliance 8.0.0 and 9.0.0 specifies permissions for a security-critical resource in a way that allows that resou CVE-2017-145909.1Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. An attacker who has permission to cr CVE-2017-145919.0Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercuria CVE-2017-145928.8Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission t CVE-2017-145938.8Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission CVE-2017-145946.1The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 allows remote attacke CVE-2017-145953.7In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archi CVE-2017-145969.8In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password.