PT-2020-6903 · Atlassian · Gadgets+1

Published 2020-11-25 · Updated 2021-07-21 · CVE-2020-14191

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Atlassian Fisheye/Crucible versions prior to 4.8.4

Description The issue is related to a Denial of Service (DoS) vulnerability in the MessageBundleResource within Atlassian Gadgets, allowing remote attackers to impact the application's availability. It is also associated with incorrect cleanup or release of resources. Exploitation of this issue can enable a remote attacker to cause a denial of service.

Recommendations For versions prior to 4.8.4, update to version 4.8.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the MessageBundleResource within Atlassian Gadgets to minimize the risk of exploitation.

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2023-05491

CVE-2020-14191

Affected Products

Fisheye/Crucible

Gadgets

References · 9

• https://jira.atlassian.com/browse/CRUC-8501 · Vendor Advisory
• https://jira.atlassian.com/browse/FE-7332 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14191 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14191 · Security Note
• https://bdu.fstec.ru/vul/2023-05491 · Security Note
• https://t.me/cvenotify/6223 · Telegram Post
• https://cxsecurity.com/cveshow/CVE-2020-14191 · Note
• https://vuldb.com/ru/?id.165357 · Note
• https://t.me/cvenotify/6229 · Telegram Post