UpHeron
All vulnerabilities

Servers and applications

CVE-2012-2926

Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows…

Severity
Critical 9.1
Published
22 May 2012
Last changed
16 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
4.0.7, 4.1.10, 5.0.1
Exploit chance
66% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 12 Nov 2026
Attack
Over the network · No login needed · No user action needed
Attacker can
Read data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Sources
NVD

Description

Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.

From NVD.

Affected software

SoftwareAffected versions
ConfluenceServers and applications · cpe:a:atlassian:confluence_server
  • From 4.0 before 4.0.7
  • From 4.1 before 4.1.10
JiraServers and applications · cpe:a:atlassian:jira
  • Every version before 5.0.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2012-2926
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2012-2926