Lucene search

4497831d53eeFE-7336

HistoryNov 19, 2020 - 12:10 a.m.

A user-supplied regex in EyeQL causes ReDoS - CVE-2020-14190

2020-11-1900:10:43

4497831d53ee

jira.atlassian.com

atlassian

fisheye

crucible

remote attackers

regex denial of service

user-supplied regex

eyeql

affected versions

fixed versions

version 4.8.4

version 4.9.0

software

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

61.9%

JSON

Affected version of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL.

The affected versions are before version 4.8.4.

Affected versions:

version < 4.8.4

Fixed versions:

4.8.4
4.9.0

Affected configurations

Vulners

Node

atlassianfisheyeRange≤4.8.3

atlassianfisheyeRange<4.8.4

VendorProductVersionCPE
atlassianfisheye*cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
atlassian	fisheye	*	cpe:2.3:a:atlassian:fisheye::::::::

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

61.9%

JSON

Related for FE-7336