CVE-2012-2926 XML external entity in n/a

What is CVE-2012-2926?

CVE-2012-2926 is a critical vulnerability in Atlassian Crucible, published on 22 May 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.

Which versions are affected by CVE-2012-2926?

It affects 7 products.

Products include Atlassian Bamboo, Atlassian Confluence, Atlassian Confluence Server, Atlassian Crowd, Atlassian Crucible, Atlassian Fisheye and 1 more.

How do I fix CVE-2012-2926?

No fix has been published for CVE-2012-2926 yet. Limit exposure of the affected software until one is available.

Is CVE-2012-2926 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2012-2926 exists.

Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.

Other vulnerabilities in Atlassian Crucible

• CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Exploited Critical 9.3
• CVE-2022-26136 Auth bypass in Bamboo Data Center Critical 9.8
• CVE-2016-5229 Deserialization in n/a Critical 9.8
• CVE-2014-9757 Deserialization in n/a Critical 9.8
• CVE-2015-8360 Deserialization in n/a Critical 9.8

All Atlassian Crucible vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m4f6-29hg-8grv.