Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
atlassianSecurity-metrics-botFE-7326
HistoryOct 28, 2020 - 5:45 p.m.

Local file disclosure / path traversal within WEB-INF in Crucible - CVE-2020-29446

2020-10-2817:45:26
security-metrics-bot
jira.atlassian.com
18

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.003 Low

EPSS

Percentile

70.7%

JSON

Affected versions of Atlassian Dev Tools allow remote attackers
to browse local files via an Insecure Direct Object References (IDOR) vulnerability in WEB-INF in Fisheye/Crucible.

The affected versions are before version 4.8.5.

Affected versions:

  • version < 4.8.5

Fixed versions:

  • 4.8.5
  • 4.9.0

Affected configurations

Vulners
Node
atlassianfisheyeRangeā‰¤4.8.4
OR
atlassianfisheyeRange<4.8.5
CPENameOperatorVersion
fisheyele4.8.4
fisheyelt4.8.5

Related

nvd 2
cvelist 2
atlassian 5
prion 2
cve 2
cnvd 1
nvd
nvd
CVE-2021-43957
2022-03-16 01:15:07
CVE-2020-29446
2021-01-18 02:15:13
cvelist
cvelist
CVE-2021-43957
2022-03-14 00:00:00
CVE-2020-29446
2020-12-10 00:00:00
atlassian
atlassian
Local file disclosure / path traversal within WEB-INF in Crucible - CVE-2020-29446
2020-10-28 17:50:46
CVE-2021-43957: Bypass for CVE-2020-29446 (Local file disclosure / path traversal within WEB-INF)
2022-03-07 08:02:11
CVE-2021-43957: Bypass for CVE-2020-29446 (Local file disclosure / path traversal within WEB-INF)
2022-03-07 08:02:14
prion
prion
Directory traversal
2022-03-16 01:15:00
Spoofing
2021-01-18 02:15:00
cve
cve
CVE-2021-43957
2022-03-16 01:15:07
CVE-2020-29446
2021-01-18 02:15:13
cnvd
cnvd
Atlassian Fisheye and Crucible Directory Traversal Vulnerability
2022-03-18 00:00:00

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.003 Low

EPSS

Percentile

70.7%

JSON
Related for FE-7326
nvd2cvelist2atlassian5prion2cve2cnvd1