CVE-2018-5223

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible on the Windows operating system. All versions of Fisheye and Crucible before 4.4.6 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.3 (the fixed version for 4.5.x) are affected by this vulnerability.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Atlassian	Fisheye and Crucible	>= unspecified, < 4.4.6; >= 4.5.0, < unspecified; >= unspecified, < 4.5.3

References

http://www.securityfocus.com/bid/103665Third Party Advisory, VDB Entry
https://confluence.atlassian.com/x/Zi5sOVendor Advisory
https://confluence.atlassian.com/x/aS5sOVendor Advisory
https://jira.atlassian.com/browse/CRUC-8181Patch, Vendor Advisory
https://jira.atlassian.com/browse/FE-7014Patch, Vendor Advisory
http://www.securityfocus.com/bid/103665Third Party Advisory, VDB Entry
https://confluence.atlassian.com/x/Zi5sOVendor Advisory
https://confluence.atlassian.com/x/aS5sOVendor Advisory
https://jira.atlassian.com/browse/CRUC-8181Patch, Vendor Advisory
https://jira.atlassian.com/browse/FE-7014Patch, Vendor Advisory

Timeline

Published: Mar 29, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-52248.8Bamboo did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argu CVE-2018-52259.9In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before CVE-2018-52268.8There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going to be deleted. An at CVE-2018-52274.8Various administrative application link resources in Atlassian Application Links before version 5.4.4 allow remote attackers with administra CVE-2018-52286.1The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScr CVE-2018-52295.4The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to injec CVE-2018-52306.1The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 CVE-2018-52317.5The ForgotLoginDetails resource in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before v CVE-2018-52326.1The EditIssue.jspa resource in Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.10.1 allows remote attackers to i CVE-2018-52336.1Cross-site scripting (XSS) vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to inject CVE-2018-52348.0The Norton Core router prior to v237 may be susceptible to a command injection exploit. This is a type of attack in which the goal is execut CVE-2018-52356.0Norton Utilities (prior to 16.0.3.44) may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an