CVE-2012-2928

Published: May 22, 2012Modified: Apr 29, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

The Gliffy plugin before 3.7.1 for Atlassian JIRA, and before 4.2 for Atlassian Confluence, does not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.

Affected (28)

Products: Atlassian: Jira, Confluence Server · Gliffy: Gliffy

2 products

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Atlassian Jira	Up to 5.0.0

Configuration B

27 vulnerable

Vulnerable Software	Affected Versions
Gliffy Gliffy	Up to 3.7
Gliffy Gliffy	Version 1.0.1
Gliffy Gliffy	Version 2.0.0
Gliffy Gliffy	Version 2.0.1
Gliffy Gliffy	Version 2.1.0
Gliffy Gliffy	Version 2.1.1
Gliffy Gliffy	Version 2.1.2
Gliffy Gliffy	Version 2.1.3
Gliffy Gliffy	Version 2.2.0
Gliffy Gliffy	Version 2.2.1
Gliffy Gliffy	Version 2.2.2
Gliffy Gliffy	Version 3.0.0
Gliffy Gliffy	Version 3.0.1
Gliffy Gliffy	Version 3.0.2
Gliffy Gliffy	Version 3.0.3
Gliffy Gliffy	Version 3.0.4
Gliffy Gliffy	Version 3.0.5
Gliffy Gliffy	Version 3.1.0
Gliffy Gliffy	Version 3.1.1
Gliffy Gliffy	Version 3.1.2
Gliffy Gliffy	Version 3.1.3
Gliffy Gliffy	Version 3.1.4
Gliffy Gliffy	Version 3.5.2
Gliffy Gliffy	Version 3.5
Gliffy Gliffy	Version 3.6.1
Gliffy Gliffy	Version 3.6
Atlassian Confluence Server	Version 4.1.9