CVE-2021-43958

CVE-2021-43958 affects Atlassian Fisheye and Crucible, where REST resources permitted brute-force authentication due to not enforcing maximum failed login limits and CAPTCHA. Versions affected: all prior to 4.8.9. Fixed in 4.8.9. Impact is user authentication bypass via excessive login attempts; ...

CVE-2021-43958

Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and therefore required solving a CAPTCHA in addition to providing user credentials...

CVE-2021-43958

Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and therefore required solving a CAPTCHA in addition to providing user credentials...

CVE-2021-43957

Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References IDOR vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9...

CVE-2021-43957

Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References IDOR vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9...

CVE-2021-43957

CVE-2021-43957 describes an Insecure Direct Object References (IDOR) vulnerability in Atlassian Fisheye & Crucible that allows remote attackers to browse local files via the WEB-INF directory and bypass the fix for CVE-2020-29446 due to insufficient URL decoding. Affected software: Atlassian Fish...

CVE-2021-43956

The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnerability...

CVE-2021-43956

The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnerability...

CVE-2021-43956

CVE-2021-43956 affects Atlassian Fisheye and Crucible prior to 4.8.9 due to a prototype-pollution flaw in the jQuery deserialize library. The root cause is the vulnerability’s ability to inject arbitrary HTML and/or JavaScript via deserialization, enabling remote attackers to exploit affected dep...

CVE-2021-43955

The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about installation directories via information disclosure vulnerability...

CVE-2021-43955

CVE-2021-43955 affects Atlassian Fisheye and Crucible, where the /rest-service-fecru/server-v1 resource allows authenticated remote attackers to disclose installation-directory information. Affected: Fisheye/Crucible prior to version 4.8.9. Impact is information disclosure; no exploitation detail...

CVE-2021-43955

The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about installation directories via information disclosure vulnerability...

CVE-2021-43957: Authorization Bypass Through User-Controlled Key

Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References IDOR vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9...

CVE-2021-43956: Improperly Controlled Modification of Object Prototype Attributes

The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnerability...

CVE-2021-43958: Improper Restriction of Excessive Authentication Attempts

Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and therefore required solving a CAPTCHA in addition to providing user credentials...

PT-2022-6908 · Atlassian · Crucible +1

Name of the Vulnerable Software and Affected Versions: Fisheye and Crucible versions prior to 4.8.9 Description: The issue is related to insufficient protection of service data in Fisheye and Crucible, allowing a remote attacker to gain unauthorized access to protected information. The...

PT-2022-11955 · Atlassian · Fisheye/Crucible

Name of the Vulnerable Software and Affected Versions: Atlassian Fisheye & Crucible versions prior to 4.8.9 Description: The issue allows remote attackers to browse local files due to an Insecure Direct Object References IDOR vulnerability in the WEB-INF directory. This is possible because of a...

PT-2022-11956 · Atlassian · Crucible +1

Name of the Vulnerable Software and Affected Versions: Fisheye and Crucible versions prior to 4.8.9 Description: The issue allows remote attackers to brute force user login credentials due to the improper restriction of excess authentication attempts. This is because rest resources did not check ...

CVE-2021-43955: Undefined Security Weakness

The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about installation directories via information disclosure vulnerability...

Atlassian Fisheye and Crucible Server-Side Request Forgery Vulnerabilities

Atlassian Fisheye is a suite of source code depth viewers.Crucible is a suite of code review tools. Atlassian Fisheye and Crucible have a server-side request forgery vulnerability due to file and network resource enumeration in the DefaultRepositoryAdminService. An authenticated, remote attacker...