PT-2018-6627 · Atlassian · Fisheye/Crucible

Adam Slaski · Published 2018-02-02 · Updated 2019-10-09 · CVE-2017-18035

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Atlassian Fisheye and Crucible versions prior to 4.5.1 and 4.6.0

Description: The issue concerns a missing permissions check in the /rest/review-coverage-chart/1.0/data//.json resource. This allows remote attackers without access to a particular repository to determine its existence and access review coverage statistics.

Recommendations: For versions prior to 4.5.1, update to version 4.5.1 or later. For versions prior to 4.6.0, update to version 4.6.0 or later.

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

CVE-2017-18035

Affected Products

Fisheye/Crucible

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-18035 · Security Note
• https://jira.atlassian.com/browse/CRUC-8163 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-18035 · Vendor Advisory
• https://jira.atlassian.com/browse/FE-6996 · Vendor Advisory