CVE-2017-7357

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Hipchat Server before 2.2.3 allows remote authenticated users with Server Administrator level privileges to execute arbitrary code by importing a file.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/archive/1/540410/100/0/threaded
http://www.securityfocus.com/bid/97621Third Party Advisory, VDB Entry
https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-04-12-887732597.htmlVendor Advisory
https://jira.atlassian.com/browse/HCPUB-2903Issue Tracking, Patch
http://www.securityfocus.com/archive/1/540410/100/0/threaded
http://www.securityfocus.com/bid/97621Third Party Advisory, VDB Entry
https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-04-12-887732597.htmlVendor Advisory
https://jira.atlassian.com/browse/HCPUB-2903Issue Tracking, Patch

Timeline

Published: Apr 14, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-73587.3In LightDM through 1.22.0, a directory traversal issue in debian/guest-account.sh allows local attackers to own arbitrary directory path loc CVE-2017-73596.1Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack.CVE-2017-73606.1Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack.CVE-2017-73616.1Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack.CVE-2017-73626.1Pixie 1.0.4 allows an admin/index.php s=publish&m=dynamic&x= XSS attack.CVE-2017-73636.1Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack.CVE-2017-73649.8In all Qualcomm products with Android releases from CAF using the Linux kernel, in function __mdss_fb_copy_destscaler_data(), variable ds_da CVE-2017-73657.8In all Android releases from CAF using the Linux kernel, a buffer overread can occur if a particular string is not NULL terminated.CVE-2017-73665.5In all Android releases from CAF using the Linux kernel, a KGSL ioctl was not validating all of its parameters.CVE-2017-73677.8In all Android releases from CAF using the Linux kernel, an integer underflow vulnerability exists while processing the boot image.CVE-2017-73687.0In all Android releases from CAF using the Linux kernel, a race condition potentially exists in the ioctl handler of a sound driver.CVE-2017-73697.8In all Android releases from CAF using the Linux kernel, an array index in an ALSA routine is not properly validating potentially leading to