PT-2018-6627 · Atlassian · Fisheye/Crucible

Adam Slaski · Publicado 2018-02-02 · Atualizado 2019-10-09 · CVE-2017-18035

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Atlassian Fisheye and Crucible versions prior to 4.5.1 and 4.6.0

Description: The issue concerns a missing permissions check in the /rest/review-coverage-chart/1.0/data//.json resource. This allows remote attackers without access to a particular repository to determine its existence and access review coverage statistics.

Recommendations: For versions prior to 4.5.1, update to version 4.5.1 or later. For versions prior to 4.6.0, update to version 4.6.0 or later.

Correção

Improper Access Control

Missing Authorization

Enumeração de Fraquezas

CWE-284

CWE-862

Identificadores relacionados

CVE-2017-18035

Produtos afetados

Fisheye/Crucible

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-18035 · Nota de Segurança
• https://jira.atlassian.com/browse/CRUC-8163 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-18035 · Aviso do Fabricante
• https://jira.atlassian.com/browse/FE-6996 · Aviso do Fabricante