CVE-2021-43957

2022-03-1400:00:00

atlassian

www.cve.org

6.5 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.8%

JSON

Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9.

CNA Affected

[
  {
    "product": "Fisheye",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "4.8.9",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Crucible",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "4.8.9",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]