Atlassian HipChat Server 1.0 < 2.2.4 Image Upload RCE

High Nessus Plugin ID 100160


The remote chat server is affected by a remote code execution vulnerability.


The version of Atlassian HipChat Server installed on the remote host is 1.0 or later but prior to 2.2.4. It is, therefore, affected by a remote code execution vulnerability due to improper validation of uploaded images. An authenticated, remote attacker can exploit this, via a specially crafted image, to execute arbitrary code.


Update to Atlassian HipChat Server version 2.2.4 or later.
Alternatively, apply the patch specified in the vendor advisory.

See Also

Plugin Details

Severity: High

ID: 100160

File Name: atlassian_hipchat_server_2_2_4.nasl

Version: $Revision: 1.2 $

Type: local

Family: Misc.

Published: 2017/05/12

Modified: 2017/08/14

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 9

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:ND


Base Score: 9.9

Temporal Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:X

Vulnerability Information

CPE: cpe:/a:atlassian:hipchat_server

Required KB Items: Host/HipChat, Host/HipChat/version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2017/04/24

Vulnerability Publication Date: 2017/04/24

Reference Information

CVE: CVE-2017-8080

BID: 98262

OSVDB: 156578

IAVA: 2017-A-0139