Vulnerabilites related to Atlassian - Fisheye
Vulnerability from fkie_nvd
Published
2018-10-16 13:29
Modified
2024-11-21 03:47
Severity ?
Summary
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8314 | Issue Tracking, Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7105 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8314 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7105 | Issue Tracking, Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "A828255D-9BC1-4A84-A48A-510D7BDB6376", versionEndExcluding: "4.6.1", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "04FBB151-76D4-45C1-A2D1-9FAC282B6048", versionEndExcluding: "4.6.1", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.", }, { lang: "es", value: "El instalador de Microsoft Windows para Atlassian Fisheye y Crucible en versiones anteriores a la 4.6.1 permite que atacantes locales escalen privilegios debido a permisos débiles en el directorio de instalación.", }, ], id: "CVE-2018-13399", lastModified: "2024-11-21T03:47:01.730", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "LOCAL", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 4.6, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:L/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 3.9, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, exploitabilityScore: 1.8, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2018-10-16T13:29:00.593", references: [ { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8314", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7105", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8314", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7105", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-732", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2017-11-29 21:29
Modified
2024-11-21 03:13
Severity ?
Summary
Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | http://www.securityfocus.com/bid/102194 | Third Party Advisory, VDB Entry | |
| security@atlassian.com | https://confluence.atlassian.com/x/plcGO | Issue Tracking, Mitigation, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/102194 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://confluence.atlassian.com/x/plcGO | Issue Tracking, Mitigation, Vendor Advisory |
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "8D3D670E-B0C7-4D4F-8E9B-C74BC2400146", versionEndExcluding: "4.4.3", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crucible:4.5.0:*:*:*:*:*:*:*", matchCriteriaId: "E86BAE07-084C-411C-AAD9-676E8FC50703", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "DE9E2E63-BA2B-487D-90C2-45D0DDBED383", versionEndExcluding: "4.4.3", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:4.5.0:*:*:*:*:*:*:*", matchCriteriaId: "DC4FA7F3-F6C3-4976-9E2A-2C7A6FE8329D", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software.", }, { lang: "es", value: "Atlassian Fisheye y Crucible en versiones anteriores a la 4.3 y la versión 4.5.0 son vulnerables a una inyección de argumentos mediante nombres de archivo en repositorios Mercurial. Esto permite que los atacantes ejecuten código arbitrario en un sistema que ejecute el software afectado.", }, ], id: "CVE-2017-14591", lastModified: "2024-11-21T03:13:09.873", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "COMPLETE", baseScore: 9.3, confidentialityImpact: "COMPLETE", integrityImpact: "COMPLETE", vectorString: "AV:N/AC:M/Au:N/C:C/I:C/A:C", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 10, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.0", }, exploitabilityScore: 2.2, impactScore: 6, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2017-11-29T21:29:00.217", references: [ { source: "security@atlassian.com", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/102194", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Mitigation", "Vendor Advisory", ], url: "https://confluence.atlassian.com/x/plcGO", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/102194", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Mitigation", "Vendor Advisory", ], url: "https://confluence.atlassian.com/x/plcGO", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-88", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2022-07-20 18:15
Modified
2024-11-21 06:53
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.
References
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*", matchCriteriaId: "218C960A-04C6-4242-BEBA-C81CF5F1F722", versionEndExcluding: "7.2.10", versionStartIncluding: "7.2.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*", matchCriteriaId: "E360CDE0-FD1E-4337-8268-DB89CF605EE0", versionEndExcluding: "8.0.9", versionStartIncluding: "8.0.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*", matchCriteriaId: "C0913EE0-2046-4E7E-966D-DC894E34D12B", versionEndExcluding: "8.1.8", versionStartIncluding: "8.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*", matchCriteriaId: "D182C1B1-A5FF-4777-9835-4E9114BB68DC", versionEndExcluding: "8.2.4", versionStartIncluding: "8.2.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", matchCriteriaId: "4DCD53E4-3169-4E8A-88D1-38BE51D09DD3", versionEndExcluding: "7.6.16", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", matchCriteriaId: "9B878E40-95A7-40A7-9C52-6BC0C2FD3F54", versionEndExcluding: "7.17.8", versionStartIncluding: "7.7.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", matchCriteriaId: "46305D5A-7F7B-4A04-9DAD-E582D1193A7E", versionEndExcluding: "7.19.5", versionStartIncluding: "7.18.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", matchCriteriaId: "A96B135B-9272-457E-A557-6566554262D3", versionEndExcluding: "7.20.2", versionStartIncluding: "7.20.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", matchCriteriaId: "62956861-BEDE-40C8-B628-C831087E7BDB", versionEndExcluding: "7.21.2", versionStartIncluding: "7.21.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bitbucket:8.0.0:*:*:*:*:*:*:*", matchCriteriaId: "7A85565F-3F80-4E00-A706-AB4B2EAA4AFB", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bitbucket:8.1.0:*:*:*:*:*:*:*", matchCriteriaId: "99E2E3C0-CDF0-4D79-80A6-85E71B947ED9", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "1C543CA6-8E8A-476C-AB27-614DF4EC68A5", versionEndExcluding: "7.4.17", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "45FD913B-45DE-4CA8-9733-D62F54B19E74", versionEndExcluding: "7.13.7", versionStartIncluding: "7.5.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "12E753EB-0D31-448B-B8DE-0A95434CC97C", versionEndExcluding: "7.14.3", versionStartIncluding: "7.14.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "DE114494-74F0-454C-AAC4-8B8E5F1C67D0", versionEndExcluding: "7.15.2", versionStartIncluding: "7.15.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "90BB3572-29ED-415F-AD34-00EB76271F9C", versionEndExcluding: "7.16.4", versionStartIncluding: "7.16.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "30EF756A-B4E9-4E5D-BE6F-02CE95F12C9C", versionEndExcluding: "7.17.4", versionStartIncluding: "7.17.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_data_center:7.18.0:*:*:*:*:*:*:*", matchCriteriaId: "A56B6A10-E23F-49EF-8C07-1AEDFCAE2788", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", matchCriteriaId: "AE8BE634-1599-4790-9410-6CA43BC60C4D", versionEndExcluding: "7.4.17", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", matchCriteriaId: "52E68DFD-48F5-4949-AFEA-3829CA5DFC04", versionEndExcluding: "7.13.7", versionStartIncluding: "7.5.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", matchCriteriaId: "5DCDEC6C-4515-4CAA-9D82-7BF68A3AAE7E", versionEndExcluding: "7.14.3", versionStartIncluding: "7.14.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", matchCriteriaId: "B9948F94-DF67-4E3C-8CD4-417D57FBC60F", versionEndExcluding: "7.15.2", versionStartIncluding: "7.15.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", matchCriteriaId: "30E63ECB-85A8-4D41-A9B5-9FFF18D9CDB1", versionEndExcluding: "7.16.4", versionStartIncluding: "7.16.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", matchCriteriaId: "694171BD-FAE2-472C-8183-04BCA2F7B9A7", versionEndExcluding: "7.17.4", versionStartIncluding: "7.17.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_server:7.18.0:*:*:*:*:*:*:*", matchCriteriaId: "0AC5E81B-DA4B-45E7-9584-4B576E49FD8B", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", matchCriteriaId: "EE028964-B3FC-4883-9967-68DE46EE7F6F", versionEndExcluding: "4.3.8", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", matchCriteriaId: "57DC9E2A-4C89-420D-9330-F11E56BF2F83", versionEndExcluding: "4.4.2", versionStartIncluding: "4.4.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crowd:5.0.0:*:*:*:*:*:*:*", matchCriteriaId: "C50A718F-C67B-4462-BB7E-F80408DEF07D", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "92329A2E-13E8-4818-85AB-3E7F479411EF", versionEndExcluding: "4.8.10", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "30DDE751-CA88-4CFB-9E60-4243851B4B53", versionEndExcluding: "4.8.10", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "D91B8507-A7A7-4B74-9999-F1DEA9F487A9", versionEndExcluding: "8.13.22", versionStartIncluding: "8.13.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "963AE427-2897-42CB-AE11-654D700E690B", versionEndExcluding: "8.20.10", versionStartIncluding: "8.14.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "A7CD8891-BB97-4AD3-BEE4-6CCA0D8A2D85", versionEndExcluding: "8.22.4", versionStartIncluding: "8.21.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", matchCriteriaId: "E73A5202-6114-48E6-8F9B-C03B2E707055", versionEndExcluding: "8.13.22", versionStartIncluding: "8.13.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", matchCriteriaId: "D22AB11D-1D73-45DC-803C-146EFED18CDA", versionEndExcluding: "8.20.10", versionStartIncluding: "8.14.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", matchCriteriaId: "BB2091E9-0B14-4786-852F-454C56D20839", versionEndExcluding: "8.22.4", versionStartIncluding: "8.21.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*", matchCriteriaId: "1451C219-8AAA-4165-AE2C-033EF7B6F93A", versionEndExcluding: "4.13.22", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:*", matchCriteriaId: "BD23F987-0F14-4938-BB51-4EE61C24EB62", versionEndExcluding: "4.13.22", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*", matchCriteriaId: "39F77953-41D7-4398-9F07-2A057A993762", versionEndExcluding: "4.20.10", versionStartIncluding: "4.14.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*", matchCriteriaId: "CADBE0E7-36D9-4F6F-BEE6-A1E0B9428C2A", versionEndExcluding: "4.20.10", versionStartIncluding: "4.14.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*", matchCriteriaId: "DC0DB08B-2034-4691-A7B2-3E5F8B6318B1", versionEndExcluding: "4.22.4", versionStartIncluding: "4.21.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*", matchCriteriaId: "97A17BE7-7CCC-46D8-A317-53E2B026DF6E", versionEndExcluding: "4.22.4", versionStartIncluding: "4.21.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.", }, { lang: "es", value: "Una vulnerabilidad en varios productos de Atlassian permite a un atacante remoto no autenticado omitir los filtros Servlet usados por aplicaciones de primera y tercera parte. El impacto depende de los filtros usados por cada aplicación y de cómo son usados los filtros. Esta vulnerabilidad puede resultar en una omisión de la autenticación y un ataque de tipo cross-site scripting. Atlassian ha publicado actualizaciones que corrigen la causa principal de esta vulnerabilidad, pero no ha enumerado exhaustivamente todas las consecuencias potenciales de esta vulnerabilidad. Están afectadas las versiones de Atlassian Bamboo anteriores a 8.0.9, desde 8.1.0 hasta 8.1.8, y desde la 8.2.0 hasta 8.2.4. Las versiones de Atlassian Bitbucket están afectadas anteriores a 7.6.16, desde la 7.7.0 anteriores a 7.17.8, desde la 7.18.0 anteriores a 7.19.5, desde la 7.20.0 anteriores a 7.20.2, desde la 7.21.0 anteriores a 7.21.2, y las versiones 8.0.0 y 8.1.0. Están afectadas las versiones de Atlassian Confluence anteriores a 7.4.17, desde la 7.5.0 anteriores a 7.13.7, desde la 7.14.0 anteriores a 7.14.3, desde la 7.15.0 anteriores a 7.15.2, desde la 7.16.0 anteriores a 7.16.4, desde la 7.17.0 anteriores a 7.17.4 y la versión 7.21.0. Están afectadas las versiones de Atlassian Crowd anteriores a 4.3.8, desde la 4.4.0 hasta 4.4.2, y la versión 5.0.0. Están afectadas las versiones de Atlassian Fisheye y Crucible anteriores a 4.8.10. Están afectadas las versiones de Atlassian Jira anteriores a 8.13.22, desde la 8.14.0 hasta 8.20.10, y desde la 8.21.0 hasta 8.22.4. Las versiones de Atlassian Jira Service Management están afectadas anteriores a 4.13.22, desde la 4.14.0 anteriores a 4.20.10, y desde la 4.21.0 anteriores a 4.22.4", }, ], id: "CVE-2022-26136", lastModified: "2024-11-21T06:53:30.297", metrics: { cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "134c704f-9b21-4f2e-91b3-4a467353bcc0", type: "Secondary", }, ], }, published: "2022-07-20T18:15:08.487", references: [ { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/BAM-21795", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/BSERV-13370", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CONFSERVER-79476", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8541", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CWD-5815", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7410", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/JRASERVER-73897", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/JSDSERVER-11863", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/BAM-21795", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/BSERV-13370", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CONFSERVER-79476", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8541", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CWD-5815", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7410", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/JRASERVER-73897", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/JSDSERVER-11863", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-180", }, ], source: "security@atlassian.com", type: "Secondary", }, { description: [ { lang: "en", value: "CWE-287", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2020-11-25 22:15
Modified
2024-11-21 05:02
Severity ?
Summary
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the MessageBundleResource within Atlassian Gadgets. The affected versions are before version 4.8.4.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8501 | Issue Tracking, Patch, Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7332 | Issue Tracking, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8501 | Issue Tracking, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7332 | Issue Tracking, Patch, Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "31A5B1B9-5B8B-4838-97C7-3287A715DA52", versionEndExcluding: "4.8.4", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "5ECD6A49-2A44-4220-97F1-E5D44BAFFF34", versionEndExcluding: "4.8.4", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the MessageBundleResource within Atlassian Gadgets. The affected versions are before version 4.8.4.", }, { lang: "es", value: "Las versiones afectadas de Atlassian Fisheye/Crucible permiten a atacantes remotos afectar la disponibilidad de la aplicación por medio de una vulnerabilidad de Denegación de Servicio (DoS) en la función MessageBundleResource dentro de Atlassian Gadgets. Las versiones afectadas son anteriores a 4.8.4", }, ], id: "CVE-2020-14191", lastModified: "2024-11-21T05:02:50.273", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 3.6, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2020-11-25T22:15:11.220", references: [ { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8501", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7332", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8501", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7332", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "NVD-CWE-noinfo", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2011-12-15 03:57
Modified
2024-11-21 01:33
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the user profile feature in Atlassian FishEye before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) snippets in a user comment, which is not properly handled in a Confluence page, or (2) the user profile display name, which is not properly handled in a FishEye page.
References
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:fisheye:1.3:*:*:*:*:*:*:*", matchCriteriaId: "65DC909F-52E4-492E-8DD5-541CA8EF0DA8", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:1.4:*:*:*:*:*:*:*", matchCriteriaId: "4AED84F5-8664-4632-81BB-CE8ACF91995B", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:1.4.1:*:*:*:*:*:*:*", matchCriteriaId: "287BD1C8-D378-4FA3-ABFD-BC8C35ECDB91", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:1.4.2:*:*:*:*:*:*:*", matchCriteriaId: "53F57BCA-CF2C-4555-8113-B83081081568", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:1.4.3:*:*:*:*:*:*:*", matchCriteriaId: "11DE82E5-27D6-422D-8AE9-E8A0B751C0FD", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:1.5.0:*:*:*:*:*:*:*", matchCriteriaId: "F8C4A487-E8F6-418E-9272-FC90A5AD4BD7", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:1.5.1:*:*:*:*:*:*:*", matchCriteriaId: "9052BBA3-D7FE-4F7F-9304-F0FE0B9D41E7", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:1.5.2:*:*:*:*:*:*:*", matchCriteriaId: "D8CBCEFF-D3CD-48DD-91D0-3E51C1A6D0BD", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:1.5.3:*:*:*:*:*:*:*", matchCriteriaId: "CA0553DC-817F-4666-9BDA-E914980CBA73", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:1.5.4:*:*:*:*:*:*:*", matchCriteriaId: "0E968CFA-4538-4726-994C-60374FBAA18E", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:1.6.0:*:*:*:*:*:*:*", matchCriteriaId: "A81AD0AE-14AA-432B-877E-E80785016A58", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:1.6.1:*:*:*:*:*:*:*", matchCriteriaId: "CCD765B8-1A7A-49FD-B3E1-A7BECFF21B34", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:1.6.2:*:*:*:*:*:*:*", matchCriteriaId: "D1871F0B-734A-4A41-9F2E-12A5C0A9273B", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:1.6.3:*:*:*:*:*:*:*", matchCriteriaId: "C4E9E953-3167-4E0E-9FE5-12755C8F2227", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:1.6.4:*:*:*:*:*:*:*", matchCriteriaId: "3D3FA30A-4995-487E-9BD4-D1EBACF83BAD", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:1.6.5.a:*:*:*:*:*:*:*", matchCriteriaId: "87C89AB2-D94F-462D-9F9F-A863C43168F1", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:1.6.6:*:*:*:*:*:*:*", matchCriteriaId: "3243C58A-3D11-40A0-8545-4E88640EA50A", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.0:*:*:*:*:*:*:*", matchCriteriaId: "2E6B17CA-DFC4-4B8F-BADD-D9B2E2B3A1D8", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.0:beta:*:*:*:*:*:*", matchCriteriaId: "DD299128-2B6F-436C-A001-0FDCA4F4F476", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.0:beta2:*:*:*:*:*:*", matchCriteriaId: "5BF0F3A4-D1F5-46CD-B304-4E6704FACEED", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.0:beta3:*:*:*:*:*:*", matchCriteriaId: "C0CB4216-BE72-40A4-9990-3E3FCF237A5A", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.0.1:*:*:*:*:*:*:*", matchCriteriaId: "2BEEC659-AD2C-46B5-9C43-846B0C161D91", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.0.2:*:*:*:*:*:*:*", matchCriteriaId: "22428683-5FA7-4159-9599-CCBC3D48FC17", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.0.3:*:*:*:*:*:*:*", matchCriteriaId: "DCD7572C-D427-4FF2-A0B9-A09308FA75A1", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.0.4:*:*:*:*:*:*:*", matchCriteriaId: "42A710A8-14B1-4521-8218-7E877B5E8612", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.0.5:*:*:*:*:*:*:*", matchCriteriaId: "BA512020-7A99-4CB9-A4F5-625D3B3CEE8C", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.0.6:*:*:*:*:*:*:*", matchCriteriaId: "10FC2876-4E44-46A3-9393-7EDCB3E7118B", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.1.0:*:*:*:*:*:*:*", matchCriteriaId: "31C7041B-C0A4-4B56-AAAF-A9DC5CDA907A", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.1.1:*:*:*:*:*:*:*", matchCriteriaId: "BD2BE240-FBAA-40D5-A331-1B92C1AC06A5", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.1.2:*:*:*:*:*:*:*", matchCriteriaId: "174D65AC-FC95-4843-BCA9-5A099720CF97", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.1.3:*:*:*:*:*:*:*", matchCriteriaId: "5C0DFDA0-8D43-4742-835B-C1429FC3E954", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.1.4:*:*:*:*:*:*:*", matchCriteriaId: "6A90B31C-3675-4B42-BF20-BA1DEFC43143", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.2.0:*:*:*:*:*:*:*", matchCriteriaId: "4A2E3E19-2936-4A35-ABA3-DCF20B81A3D5", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.2.1:*:*:*:*:*:*:*", matchCriteriaId: "8539DA5F-51F4-46B6-BA4E-F4DBD23E02D0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.2.3:*:*:*:*:*:*:*", matchCriteriaId: "E031757C-525F-48FA-A13A-548B60CF5A3E", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.3.0:*:*:*:*:*:*:*", matchCriteriaId: "B6378292-AF21-4D55-B91B-E1EC118B9434", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.3.1:*:*:*:*:*:*:*", matchCriteriaId: "E1E808FB-EBBC-4409-A139-7AF11D359562", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.3.2:*:*:*:*:*:*:*", matchCriteriaId: "615D9240-7E40-438E-A16A-2CE15D187DB9", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.3.3:*:*:*:*:*:*:*", matchCriteriaId: "CF4AD14D-452D-493F-A9EB-E87C88BC7CF9", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.3.4:*:*:*:*:*:*:*", matchCriteriaId: "7B0CFD4B-8CCE-4928-AF36-7E4FEA9C37C3", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.3.5:*:*:*:*:*:*:*", matchCriteriaId: "B7D4EA65-22BD-41BF-A2F2-9C3AFE6AAAAF", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.3.6:*:*:*:*:*:*:*", matchCriteriaId: "081BE403-480B-4F8B-832F-3D9D33C546C3", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.3.7:*:*:*:*:*:*:*", matchCriteriaId: "08A180D7-FA9A-4F36-9571-04EAD40FA7AE", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.3.8:*:*:*:*:*:*:*", matchCriteriaId: "56027DE1-1034-4B2B-BD01-4D9CE56A66ED", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.4.0:*:*:*:*:*:*:*", matchCriteriaId: "D67D8010-D25C-4D1E-AFCE-3E38DA467574", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.4.1:*:*:*:*:*:*:*", matchCriteriaId: "76EBF4C8-E718-4F55-B6F3-0C14179E7A59", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.4.2:*:*:*:*:*:*:*", matchCriteriaId: "5104A993-424E-44CE-A859-54707B5FF73E", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.4.3:*:*:*:*:*:*:*", matchCriteriaId: "FD591B70-0EB8-4881-8C64-CD86BF7C0990", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.4.4:*:*:*:*:*:*:*", matchCriteriaId: "852880EF-9870-4BE5-BA36-D01682757D95", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.4.5:*:*:*:*:*:*:*", matchCriteriaId: "0BA208AF-8F62-46F6-91B5-80C867B757C5", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.4.6:*:*:*:*:*:*:*", matchCriteriaId: "5FEC17DB-89BA-4C24-BE79-6FCB1199CA9C", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.5.0:*:*:*:*:*:*:*", matchCriteriaId: "F41AE4F9-EB8C-4975-ABFB-19D91D90ADF6", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.5.1:*:*:*:*:*:*:*", matchCriteriaId: "78940DF8-94DA-4725-A5C9-7D0E0B45F067", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.5.2:*:*:*:*:*:*:*", matchCriteriaId: "87AF8F3A-ECBC-47AE-83C1-C7B838A9184C", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.5.3:*:*:*:*:*:*:*", matchCriteriaId: "DC9B4F0C-A9A7-45FA-A2D4-FBFC39B8B173", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:2.5.4:*:*:*:*:*:*:*", matchCriteriaId: "F3347FF5-548E-4D6D-A07D-37872A12DE54", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Multiple cross-site scripting (XSS) vulnerabilities in the user profile feature in Atlassian FishEye before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) snippets in a user comment, which is not properly handled in a Confluence page, or (2) the user profile display name, which is not properly handled in a FishEye page.", }, { lang: "es", value: "Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en la funcionalidad de perfil de usuario de Atlassian FishEye en versiones anteriores a 2.5.5. Permite a usuarios remotos inyectar codigo de script web o código HTML de su elección a través de (1) \"snippets\" en un comentario de usuario, que no son manejados apropiadamente en una página Confluence, o (2) el nombre para mostrar del perfil de usuario, que no es apropiadamente procesado en una página FishEye.", }, ], id: "CVE-2011-4822", lastModified: "2024-11-21T01:33:03.923", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], }, published: "2011-12-15T03:57:34.433", references: [ { source: "cve@mitre.org", url: "http://confluence.atlassian.com/display/FISHEYE/FishEye+and+Crucible+Security+Advisory+2011-11-22", }, { source: "cve@mitre.org", url: "http://osvdb.org/77263", }, { source: "cve@mitre.org", url: "http://osvdb.org/77264", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/46975", }, { source: "cve@mitre.org", url: "http://www.securityfocus.com/bid/50762", }, { source: "cve@mitre.org", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/71426", }, { source: "cve@mitre.org", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/71427", }, { source: "cve@mitre.org", url: "https://jira.atlassian.com/browse/FE-3797", }, { source: "cve@mitre.org", url: "https://jira.atlassian.com/browse/FE-3798", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://confluence.atlassian.com/display/FISHEYE/FishEye+and+Crucible+Security+Advisory+2011-11-22", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://osvdb.org/77263", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://osvdb.org/77264", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/46975", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securityfocus.com/bid/50762", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/71426", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/71427", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://jira.atlassian.com/browse/FE-3797", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://jira.atlassian.com/browse/FE-3798", }, ], sourceIdentifier: "cve@mitre.org", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2018-02-19 14:29
Modified
2024-11-21 03:19
Severity ?
Summary
Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the location setting of a configured repository.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | http://www.securityfocus.com/bid/103095 | Third Party Advisory, VDB Entry | |
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8175 | Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7008 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/103095 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8175 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7008 | Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "97718354-9B00-4E93-A879-7423456E0344", versionEndExcluding: "4.4.3", versionStartIncluding: "4.4.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "C1A5C301-8708-4774-9DC5-717E88A805F0", versionEndExcluding: "4.4.3", versionStartIncluding: "4.4.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the location setting of a configured repository.", }, { lang: "es", value: "Varios recursos en Atlassian Fisheye y Crucible en versiones anteriores a la 4.4.3 (la versión parcheada para 4.4.x) y anteriores a la 4.5.0 permite que atacantes remotos que tengan permiso para añadir o modificar un repositorio inyecten código HTML o JavaScript arbitrario mediante una vulnerabilidad Cross-Site Scripting (XSS) a través de la configuración de localización de un repositorio configurado.", }, ], id: "CVE-2017-18093", lastModified: "2024-11-21T03:19:20.767", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "LOW", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 3.5, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:S/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 6.8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.8, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "HIGH", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, exploitabilityScore: 1.7, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2018-02-19T14:29:00.457", references: [ { source: "security@atlassian.com", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/103095", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8175", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7008", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/103095", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8175", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7008", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2017-08-24 17:29
Modified
2024-11-21 03:36
Severity ?
Summary
The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the charset of a previously uploaded file.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8046 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8046 | Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "63C32D18-9A27-4D20-A0EA-A44BA2DA9E2E", versionEndIncluding: "4.4.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "BB0CDA4F-731F-4F40-9ED9-496576B93345", versionEndIncluding: "4.4.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the charset of a previously uploaded file.", }, { lang: "es", value: "El recurso review file upload en Atlassian Crucible en versiones anteriores a la 4.4.1 permite que atacantes remotos inyecten HTML o JavaScript arbitrario mediante una vulnerabilidad cross-Site Scripting (XSS) mediante el conjunto de caracteres de un archivo previamente subido.", }, ], id: "CVE-2017-9509", lastModified: "2024-11-21T03:36:17.790", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "LOW", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 3.5, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:S/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 6.8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.4, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, exploitabilityScore: 2.3, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2017-08-24T17:29:00.320", references: [ { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8046", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8046", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2019-04-30 16:29
Modified
2024-11-21 04:01
Severity ?
Summary
Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0.
References
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*", matchCriteriaId: "2693A891-F156-4E34-B8FE-C5B50B3B4864", versionEndExcluding: "5.0.11", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*", matchCriteriaId: "40944714-8855-458B-B776-0AF4E2AE7CDF", versionEndExcluding: "5.2.10", versionStartIncluding: "5.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*", matchCriteriaId: "D4225CCB-FD35-4B93-BC1E-85F0E83383E0", versionEndExcluding: "5.3.6", versionStartIncluding: "5.3.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*", matchCriteriaId: "68F3DE59-0A8E-40F9-901D-F2D3C0EA546F", versionEndExcluding: "5.4.12", versionStartIncluding: "5.4.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*", matchCriteriaId: "C5414E46-B9B0-4ABF-9DDF-C1EBB8E829AE", versionEndExcluding: "6.0.4", versionStartIncluding: "6.0.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "C1777CAE-0B14-4AD2-873F-CF5D3A0B79E4", versionEndExcluding: "6.15.2", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", matchCriteriaId: "6D64E9D0-0393-4871-AEE3-0D4CAD045EAE", versionEndExcluding: "6.15.2", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", matchCriteriaId: "CF812D66-1379-4421-B192-21BF9F51C1EE", versionEndExcluding: "3.4.3", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "5C140AB4-C751-4D25-B1E7-BC1729D25B4D", versionEndExcluding: "4.7.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "40DD6225-F761-4E32-B6E9-45A9C79D4AD2", versionEndExcluding: "4.7.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "75BBC078-951C-4109-A8E5-F13DD36CE837", versionEndExcluding: "7.13.3", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "E3A2B3FB-45D3-4DB2-B10C-68E827E72837", versionEndExcluding: "8.1.0", versionStartIncluding: "8.0.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", matchCriteriaId: "BF7E474F-E673-4414-A534-8E709AC6CBFF", versionEndExcluding: "7.13.3", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", matchCriteriaId: "660409CF-397F-4D27-A331-37414A5547E5", versionEndExcluding: "8.1.0", versionStartIncluding: "8.0.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0.", }, { lang: "es", value: "Application Links anterior a la versión 5.0.11, desde la versión 5.1.0 a la 5.2.10, desde la versión 5.3.0 a la 5.3.6, desde la versión 5.4.0 a la 5.4.12, y desde la versión 6.0.0 a la 6.0.4, permite a atacantes remotos inyectar HTML o JavaScript arbitrario por medio de una vulnerabilidad de tipo cross site scripting (XSS) en el parámetro applinkStartingUrl. El producto es usado como un complemento en varios productos de Atlassian donde se ven impactados los siguientes: Confluence anterior a la versión 6.15.2, Crucible before anterior a la versión 4.7.0, Crowd anterior a la versión 3.4.3, Fisheye anterior a la versión 4.7.0, Jira anterior a la versión 7.13.3 y versión 8.x anterior a 8.1.0.", }, ], id: "CVE-2018-20239", lastModified: "2024-11-21T04:01:08.853", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "LOW", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 3.5, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:S/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 6.8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.4, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, exploitabilityScore: 2.3, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2019-04-30T16:29:00.247", references: [ { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://ecosystem.atlassian.net/browse/APL-1373", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CONFSERVER-58208", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8379", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CWD-5362", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7161", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/JRASERVER-68855", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://ecosystem.atlassian.net/browse/APL-1373", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CONFSERVER-58208", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8379", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CWD-5362", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7161", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/JRASERVER-68855", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2019-11-08 04:15
Modified
2024-11-21 04:27
Severity ?
Summary
The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira Server / Data Center before 8.3.2, Crowd / Crowd Data Center before 3.6.0, Fisheye before 4.7.2, Crucible before 4.7.2, and Bamboo before 6.10.2.
References
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:troubleshooting_and_support:*:*:*:*:*:*:*:*", matchCriteriaId: "093A33BE-D93B-4CBC-9BF3-B37207CBAD84", versionEndExcluding: "1.17.2", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*", matchCriteriaId: "A17D5A1F-2408-4768-9DC3-F850B21B64AD", versionEndExcluding: "6.10.2", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", matchCriteriaId: "BF79AB35-E420-4475-AD28-FC219C636C8B", versionEndExcluding: "6.6.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence:*:*:*:*:*:*:*:*", matchCriteriaId: "EC203A88-CA6B-4F1A-A68D-9C2CDE8F67FC", versionEndExcluding: "7.0.1", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", matchCriteriaId: "1361951B-0754-45FF-96E4-8A886C24411B", versionEndExcluding: "3.6.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "40EB5F54-C9BD-4299-A616-E3A8E20C77FB", versionEndExcluding: "4.7.2", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "452D57FA-0A0B-486F-9D4B-45487B68FFB9", versionEndExcluding: "4.7.2", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*", matchCriteriaId: "76FE371E-3000-464E-ADEE-033BF2989429", versionEndExcluding: "8.3.2", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira Server / Data Center before 8.3.2, Crowd / Crowd Data Center before 3.6.0, Fisheye before 4.7.2, Crucible before 4.7.2, and Bamboo before 6.10.2.", }, { lang: "es", value: "El plugin Atlassian Troubleshooting and Support anterior a versión 1.17.2, permite a un usuario sin privilegios iniciar escaneos de registros periódicos y enviar los resultados a una dirección de correo electrónico especificada por el usuario debido a una falta de comprobación de autorización. El mensaje de correo electrónico puede contener información de configuración sobre la aplicación en la que el plugin está instalado. Se incluye una versión vulnerable del plugin con Bitbucket Server/Data Center versiones anteriores a 6.6.0, Confluence Server / Data Center versiones anteriores a 7.0.1, Jira Server / Data Center versiones anteriores a 8.3.2, Crowd / Crowd Data Center versiones anteriores a 3.6.0, Fisheye versiones anteriores a 4.7.2, Crucible versiones anteriores a 4.7.2 y Bamboo versiones anteriores a 6.10.2.", }, ], id: "CVE-2019-15005", lastModified: "2024-11-21T04:27:51.487", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:S/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.3, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 1.4, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2019-11-08T04:15:10.307", references: [ { source: "security@atlassian.com", url: "https://herolab.usd.de/security-advisories/usd-2019-0016/", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/BAM-20647", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://herolab.usd.de/security-advisories/usd-2019-0016/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/BAM-20647", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-862", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2019-12-11 15:15
Modified
2024-11-21 04:27
Severity ?
Summary
The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the reviewedBranch parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8441 | Issue Tracking, Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7251 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8441 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7251 | Issue Tracking, Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "29546385-66E3-4353-B314-7CBE6AF06775", versionEndExcluding: "4.7.3", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "3C591C4E-A934-49B0-AF8A-AFFF7ADDD4CF", versionEndExcluding: "4.7.3", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the reviewedBranch parameter.", }, { lang: "es", value: "El recurso /plugins/servlet/branchreview en Atlassian Fisheye and Crucible versiones anteriores a 4.7.3, permite a atacantes remotos inyectar HTML o JavaScript arbitrario por medio de una vulnerabilidad de tipo cross-site scripting (XSS) en el parámetro reviewBranch.", }, ], id: "CVE-2019-15008", lastModified: "2024-11-21T04:27:51.843", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2019-12-11T15:15:14.467", references: [ { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8441", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7251", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8441", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7251", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2012-05-22 15:55
Modified
2024-11-21 01:39
Severity ?
Summary
Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| atlassian | bamboo | * | |
| atlassian | bamboo | * | |
| atlassian | confluence | * | |
| atlassian | confluence_server | * | |
| atlassian | confluence_server | * | |
| atlassian | crowd | * | |
| atlassian | crowd | * | |
| atlassian | crowd | * | |
| atlassian | crowd | * | |
| atlassian | crowd | * | |
| atlassian | crucible | * | |
| atlassian | crucible | * | |
| atlassian | crucible | * | |
| atlassian | fisheye | * | |
| atlassian | fisheye | * | |
| atlassian | fisheye | * | |
| atlassian | jira | * |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*", matchCriteriaId: "8C1EA6F7-CF4A-43C8-AD67-4A3E97D7B0BC", versionEndExcluding: "3.3.4", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*", matchCriteriaId: "5B53F201-032F-4672-A271-8D424B939775", versionEndExcluding: "3.4.5", versionStartIncluding: "3.4", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence:*:*:*:*:*:*:*:*", matchCriteriaId: "F4059F4D-831C-467C-91BC-B49BB7A5487E", versionEndExcluding: "3.5.16", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", matchCriteriaId: "9718C5D3-364A-4BD0-B60D-5FCEA8B1BAFF", versionEndExcluding: "4.0.7", versionStartIncluding: "4.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", matchCriteriaId: "121D6C9B-9746-423C-9A0A-13697F7B490B", versionEndExcluding: "4.1.10", versionStartIncluding: "4.1", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", matchCriteriaId: "EB8E3563-1CF4-4665-8CD3-CAEFFBB6B3B6", versionEndExcluding: "2.0.9", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", matchCriteriaId: "55437340-1D44-41C7-B82A-6E6473C17B62", versionEndExcluding: "2.1.2", versionStartIncluding: "2.1", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", matchCriteriaId: "68C5F90D-1AB3-409E-9A84-8EF42735BCD9", versionEndExcluding: "2.2.9", versionStartIncluding: "2.2.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", matchCriteriaId: "C99026A0-1B4A-4CF7-B7E5-DC1231302CEC", versionEndExcluding: "2.3.7", versionStartIncluding: "2.3.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", matchCriteriaId: "28E820F2-4E46-4744-9EE9-C9CDEF78B8D7", versionEndExcluding: "2.4.1", versionStartIncluding: "2.4.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "FD4C65C4-2C22-48F2-B4F6-D40915374FF1", versionEndExcluding: "2.5.8", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "263668EC-0168-4FC2-82E3-6606269AE372", versionEndExcluding: "2.6.8", versionStartIncluding: "2.6", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "B62B11D8-BC78-431B-91D4-F6CE14E0C7D0", versionEndExcluding: "2.7.12", versionStartIncluding: "2.7", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "77B117D3-9D05-4192-9A40-B4610D636DE7", versionEndExcluding: "2.5.8", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "3768A3A7-B5F8-46C7-A932-1C779C167216", versionEndExcluding: "2.6.8", versionStartIncluding: "2.6", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "4779A8F0-9CDB-46F7-9EB6-B155187218EB", versionEndExcluding: "2.7.12", versionStartIncluding: "2.7", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*", matchCriteriaId: "20F692D8-2A86-403D-82C6-363C9798BD3A", versionEndExcluding: "5.0.1", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.", }, { lang: "es", value: "Atlassian JIRA antes de v5.0.1; Confluence antes de v3.5.16, v4.0 antes de v4.0.7, y v4.1 antes del v4.1.10; 'FishEye and Crucible' antes de v2.5.8, v2.6 antes de v2.6.8, y v2.7 antes de v2.7.12; Bamboo antes de v3.3.4 y v3.4.x antes de v3.4.5, y Crowd antes de v2.0.9, v2.1 antes de v2.1.2, v2.2 antes de v2.2.9, v2.3 antes de v2.3.7 y v2.4 antes de v2.4.1 no restringen correctamente las capacidades de los analizadores XML de de terceros, lo que permite leer ficheros de su elección o causar una denegación de servicio (por excesivo consumo de recursos) a atacantes remotos a través de vectores no especificados.", }, ], id: "CVE-2012-2926", lastModified: "2024-11-21T01:39:57.133", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 6.4, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 4.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.1, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.2, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2012-05-22T15:55:02.853", references: [ { source: "cve@mitre.org", tags: [ "Patch", "Vendor Advisory", ], url: "http://confluence.atlassian.com/display/BAMBOO/Bamboo+Security+Advisory+2012-05-17", }, { source: "cve@mitre.org", tags: [ "Patch", "Vendor Advisory", ], url: "http://confluence.atlassian.com/display/CROWD/Crowd+Security+Advisory+2012-05-17", }, { source: "cve@mitre.org", tags: [ "Patch", "Vendor Advisory", ], url: "http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-05-17", }, { source: "cve@mitre.org", tags: [ "Patch", "Vendor Advisory", ], url: "http://confluence.atlassian.com/display/FISHEYE/FishEye+and+Crucible+Security+Advisory+2012-05-17", }, { source: "cve@mitre.org", tags: [ "Patch", "Vendor Advisory", ], url: "http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://osvdb.org/81993", }, { source: "cve@mitre.org", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/49146", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/53595", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", "VDB Entry", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/75682", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", "VDB Entry", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/75697", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Vendor Advisory", ], url: "http://confluence.atlassian.com/display/BAMBOO/Bamboo+Security+Advisory+2012-05-17", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Vendor Advisory", ], url: "http://confluence.atlassian.com/display/CROWD/Crowd+Security+Advisory+2012-05-17", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Vendor Advisory", ], url: "http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-05-17", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Vendor Advisory", ], url: "http://confluence.atlassian.com/display/FISHEYE/FishEye+and+Crucible+Security+Advisory+2012-05-17", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Vendor Advisory", ], url: "http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "http://osvdb.org/81993", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Not Applicable", ], url: "http://secunia.com/advisories/49146", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/53595", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/75682", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/75697", }, ], sourceIdentifier: "cve@mitre.org", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "NVD-CWE-noinfo", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2022-07-20 18:15
Modified
2024-11-21 06:53
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.
References
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*", matchCriteriaId: "218C960A-04C6-4242-BEBA-C81CF5F1F722", versionEndExcluding: "7.2.10", versionStartIncluding: "7.2.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*", matchCriteriaId: "E360CDE0-FD1E-4337-8268-DB89CF605EE0", versionEndExcluding: "8.0.9", versionStartIncluding: "8.0.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*", matchCriteriaId: "C0913EE0-2046-4E7E-966D-DC894E34D12B", versionEndExcluding: "8.1.8", versionStartIncluding: "8.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*", matchCriteriaId: "D182C1B1-A5FF-4777-9835-4E9114BB68DC", versionEndExcluding: "8.2.4", versionStartIncluding: "8.2.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", matchCriteriaId: "4DCD53E4-3169-4E8A-88D1-38BE51D09DD3", versionEndExcluding: "7.6.16", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", matchCriteriaId: "9B878E40-95A7-40A7-9C52-6BC0C2FD3F54", versionEndExcluding: "7.17.8", versionStartIncluding: "7.7.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", matchCriteriaId: "46305D5A-7F7B-4A04-9DAD-E582D1193A7E", versionEndExcluding: "7.19.5", versionStartIncluding: "7.18.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", matchCriteriaId: "A96B135B-9272-457E-A557-6566554262D3", versionEndExcluding: "7.20.2", versionStartIncluding: "7.20.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", matchCriteriaId: "62956861-BEDE-40C8-B628-C831087E7BDB", versionEndExcluding: "7.21.2", versionStartIncluding: "7.21.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bitbucket:8.0.0:*:*:*:*:*:*:*", matchCriteriaId: "7A85565F-3F80-4E00-A706-AB4B2EAA4AFB", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:bitbucket:8.1.0:*:*:*:*:*:*:*", matchCriteriaId: "99E2E3C0-CDF0-4D79-80A6-85E71B947ED9", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "1C543CA6-8E8A-476C-AB27-614DF4EC68A5", versionEndExcluding: "7.4.17", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "45FD913B-45DE-4CA8-9733-D62F54B19E74", versionEndExcluding: "7.13.7", versionStartIncluding: "7.5.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "12E753EB-0D31-448B-B8DE-0A95434CC97C", versionEndExcluding: "7.14.3", versionStartIncluding: "7.14.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "DE114494-74F0-454C-AAC4-8B8E5F1C67D0", versionEndExcluding: "7.15.2", versionStartIncluding: "7.15.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "90BB3572-29ED-415F-AD34-00EB76271F9C", versionEndExcluding: "7.16.4", versionStartIncluding: "7.16.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "30EF756A-B4E9-4E5D-BE6F-02CE95F12C9C", versionEndExcluding: "7.17.4", versionStartIncluding: "7.17.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_data_center:7.18.0:*:*:*:*:*:*:*", matchCriteriaId: "A56B6A10-E23F-49EF-8C07-1AEDFCAE2788", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", matchCriteriaId: "AE8BE634-1599-4790-9410-6CA43BC60C4D", versionEndExcluding: "7.4.17", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", matchCriteriaId: "52E68DFD-48F5-4949-AFEA-3829CA5DFC04", versionEndExcluding: "7.13.7", versionStartIncluding: "7.5.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", matchCriteriaId: "5DCDEC6C-4515-4CAA-9D82-7BF68A3AAE7E", versionEndExcluding: "7.14.3", versionStartIncluding: "7.14.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", matchCriteriaId: "B9948F94-DF67-4E3C-8CD4-417D57FBC60F", versionEndExcluding: "7.15.2", versionStartIncluding: "7.15.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", matchCriteriaId: "30E63ECB-85A8-4D41-A9B5-9FFF18D9CDB1", versionEndExcluding: "7.16.4", versionStartIncluding: "7.16.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", matchCriteriaId: "694171BD-FAE2-472C-8183-04BCA2F7B9A7", versionEndExcluding: "7.17.4", versionStartIncluding: "7.17.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:confluence_server:7.18.0:*:*:*:*:*:*:*", matchCriteriaId: "0AC5E81B-DA4B-45E7-9584-4B576E49FD8B", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", matchCriteriaId: "EE028964-B3FC-4883-9967-68DE46EE7F6F", versionEndExcluding: "4.3.8", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", matchCriteriaId: "57DC9E2A-4C89-420D-9330-F11E56BF2F83", versionEndExcluding: "4.4.2", versionStartIncluding: "4.4.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crowd:5.0.0:*:*:*:*:*:*:*", matchCriteriaId: "C50A718F-C67B-4462-BB7E-F80408DEF07D", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "92329A2E-13E8-4818-85AB-3E7F479411EF", versionEndExcluding: "4.8.10", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "30DDE751-CA88-4CFB-9E60-4243851B4B53", versionEndExcluding: "4.8.10", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "D91B8507-A7A7-4B74-9999-F1DEA9F487A9", versionEndExcluding: "8.13.22", versionStartIncluding: "8.13.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "963AE427-2897-42CB-AE11-654D700E690B", versionEndExcluding: "8.20.10", versionStartIncluding: "8.14.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", matchCriteriaId: "A7CD8891-BB97-4AD3-BEE4-6CCA0D8A2D85", versionEndExcluding: "8.22.4", versionStartIncluding: "8.21.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", matchCriteriaId: "E73A5202-6114-48E6-8F9B-C03B2E707055", versionEndExcluding: "8.13.22", versionStartIncluding: "8.13.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", matchCriteriaId: "D22AB11D-1D73-45DC-803C-146EFED18CDA", versionEndExcluding: "8.20.10", versionStartIncluding: "8.14.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", matchCriteriaId: "BB2091E9-0B14-4786-852F-454C56D20839", versionEndExcluding: "8.22.4", versionStartIncluding: "8.21.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*", matchCriteriaId: "1451C219-8AAA-4165-AE2C-033EF7B6F93A", versionEndExcluding: "4.13.22", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:*", matchCriteriaId: "BD23F987-0F14-4938-BB51-4EE61C24EB62", versionEndExcluding: "4.13.22", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*", matchCriteriaId: "39F77953-41D7-4398-9F07-2A057A993762", versionEndExcluding: "4.20.10", versionStartIncluding: "4.14.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*", matchCriteriaId: "CADBE0E7-36D9-4F6F-BEE6-A1E0B9428C2A", versionEndExcluding: "4.20.10", versionStartIncluding: "4.14.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*", matchCriteriaId: "DC0DB08B-2034-4691-A7B2-3E5F8B6318B1", versionEndExcluding: "4.22.4", versionStartIncluding: "4.21.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*", matchCriteriaId: "97A17BE7-7CCC-46D8-A317-53E2B026DF6E", versionEndExcluding: "4.22.4", versionStartIncluding: "4.21.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.", }, { lang: "es", value: "Una vulnerabilidad en diversos productos de Atlassian permite a un atacante remoto no autenticado causar que sean invocados Filtros Servlet adicionales cuando la aplicación procesa peticiones o respuestas. Atlassian ha confirmado y corregido el único problema de seguridad conocido asociado a esta vulnerabilidad: Omisión de recursos de origen cruzado (CORS). El envío de una petición HTTP especialmente diseñada puede invocar el filtro Servlet usado para responder a las peticiones CORS, resultando en una omisión de CORS. Un atacante que pueda engañar a un usuario para que solicite una URL maliciosa puede acceder a la aplicación vulnerable con los permisos de la víctima. Están afectadas las versiones de Atlassian Bamboo anteriores a 8.0.9, desde la 8.1.0 anteriores a 8.1.8 y de la 8.2.0 anteriores a 8.2.4. Las versiones de Atlassian Bitbucket están afectadas anteriores a 7.6.16, desde la 7.7.0 anteriores a 7.17.8, desde la 7.18.0 anteriores a 7.19.5, desde la 7.20.0 anteriores a 7.20.2, desde la 7.21.0 anteriores a 7.21.2, y las versiones 8.0.0 y 8.1.0. Están afectadas las versiones de Atlassian Confluence anteriores a 7.4.17, desde la 7.5.0 anteriores a 7.13.7, desde la 7.14.0 anteriores a 7.14.3, desde la 7.15.0 anteriores a 7.15.2, desde la 7.16.0 anteriores a 7.16.4, desde la 7.17.0 anteriores a 7.17.4 y la versión 7.21.0. Están afectadas las versiones de Atlassian Crowd anteriores a 4.3.8, desde la 4.4.0 hasta 4.4.2, y la versión 5.0.0. Están afectadas las versiones de Atlassian Fisheye y Crucible anteriores a 4.8.10. Están afectadas las versiones de Atlassian Jira anteriores a 8.13.22, desde la 8.14.0 hasta 8.20.10, y desde la 8.21.0 hasta 8.22.4. Las versiones de Atlassian Jira Service Management están afectadas anteriores a 4.13.22, desde la 4.14.0 anteriores a 4.20.10, y desde la 4.21.0 anteriores a 4.22.4", }, ], id: "CVE-2022-26137", lastModified: "2024-11-21T06:53:30.583", metrics: { cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 5.9, source: "134c704f-9b21-4f2e-91b3-4a467353bcc0", type: "Secondary", }, ], }, published: "2022-07-20T18:15:08.557", references: [ { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/BAM-21795", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/BSERV-13370", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CONFSERVER-79476", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8541", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CWD-5815", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7410", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/JRASERVER-73897", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/JSDSERVER-11863", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/BAM-21795", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/BSERV-13370", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CONFSERVER-79476", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8541", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CWD-5815", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7410", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/JRASERVER-73897", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/JSDSERVER-11863", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-180", }, ], source: "security@atlassian.com", type: "Secondary", }, { description: [ { lang: "en", value: "CWE-346", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2020-06-01 07:15
Modified
2024-11-21 05:32
Severity ?
Summary
The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the committerFilter parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8482 | Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7298 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8482 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7298 | Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "9C167900-D9A9-4899-97F5-E05786FAD577", versionEndExcluding: "4.8.2", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "6DDFB4DF-9514-4974-9A03-B6958415A508", versionEndExcluding: "4.8.2", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the committerFilter parameter.", }, { lang: "es", value: "El recurso de cobertura de revisión en Atlassian Fisheye y Crucible versiones anteriores a 4.8.2, permite a atacantes remotos inyectar HTML o Javascript arbitrario por medio de una vulnerabilidad de tipo cross site scripting (XSS) por medio del parámetro committerFilter.", }, ], id: "CVE-2020-4023", lastModified: "2024-11-21T05:32:10.440", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.4, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 2.5, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2020-06-01T07:15:11.157", references: [ { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8482", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7298", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8482", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7298", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2019-02-20 14:29
Modified
2024-11-21 04:01
Severity ?
Summary
The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the wbuser parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | http://www.securityfocus.com/bid/107128 | Third Party Advisory, VDB Entry | |
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8380 | Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7162 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/107128 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8380 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7162 | Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "5C140AB4-C751-4D25-B1E7-BC1729D25B4D", versionEndExcluding: "4.7.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "40DD6225-F761-4E32-B6E9-45A9C79D4AD2", versionEndExcluding: "4.7.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the wbuser parameter.", }, { lang: "es", value: "El recurso de edición de subida para una revisión en Atlassian FishEye y Crucible, en versiones anteriores a la 4.7.0, permiten que atacantes remotos inyecten HTML o JavaScript arbitrarios mediante una vulnerabilidad Cross-Site Scripting (XSS) en el parámetro wbuser.", }, ], id: "CVE-2018-20241", lastModified: "2024-11-21T04:01:09.117", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "LOW", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 3.5, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:S/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 6.8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.4, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, exploitabilityScore: 2.3, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2019-02-20T14:29:00.447", references: [ { source: "security@atlassian.com", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/107128", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8380", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7162", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/107128", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8380", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7162", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2018-02-16 18:29
Modified
2024-11-21 03:19
Severity ?
Summary
The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | http://www.securityfocus.com/bid/103079 | Third Party Advisory, VDB Entry | |
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8173 | Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7006 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/103079 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8173 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7006 | Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "97718354-9B00-4E93-A879-7423456E0344", versionEndExcluding: "4.4.3", versionStartIncluding: "4.4.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "C1A5C301-8708-4774-9DC5-717E88A805F0", versionEndExcluding: "4.4.3", versionStartIncluding: "4.4.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup.", }, { lang: "es", value: "La acción de administrador backupprogress en Atlassian Fisheye y Crucicle en versiones anteriores a la 4.4.3 (la versión solucionada para 4.4.x) y en versiones anteriores a la 4.5.0 permite que atacantes remotos con privilegios de administrador inyecten HTML o JavaScript arbitrario mediante una vulnerabilidad Cross-Site Scripting (XSS) en el nombre de archivo de una copia de seguridad.", }, ], id: "CVE-2017-18091", lastModified: "2024-11-21T03:19:20.510", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "LOW", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 3.5, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:S/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 6.8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.8, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "HIGH", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, exploitabilityScore: 1.7, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2018-02-16T18:29:00.337", references: [ { source: "security@atlassian.com", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/103079", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8173", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7006", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/103079", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8173", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7006", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2018-08-13 13:29
Modified
2024-11-21 03:47
Severity ?
Summary
Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in linked issue keys.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | http://www.securityfocus.com/bid/105096 | Third Party Advisory, VDB Entry | |
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8304 | Issue Tracking, Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7081 | Issue Tracking, Third Party Advisory, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/105096 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8304 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7081 | Issue Tracking, Third Party Advisory, Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "E7518BE5-9D07-4290-9B87-4201D5A9F5B3", versionEndExcluding: "4.6.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "D180E336-3E90-4128-B3D0-7A0F56B42CDE", versionEndExcluding: "4.6.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in linked issue keys.", }, { lang: "es", value: "Varios recursos en Atlassian FishEye y Crucible, en versiones anteriores a la 4.6.0, permiten que atacantes remotos inyecten HTML o JavaScript arbitrario mediante una vulnerabilidad Cross-Site Scripting (XSS) en las claves de envío asociadas.", }, ], id: "CVE-2018-13392", lastModified: "2024-11-21T03:47:00.900", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, exploitabilityScore: 2.8, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2018-08-13T13:29:02.090", references: [ { source: "security@atlassian.com", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/105096", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8304", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Third Party Advisory", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7081", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/105096", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8304", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Third Party Advisory", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7081", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2017-10-11 18:29
Modified
2024-11-21 03:13
Severity ?
Summary
Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the dialog parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | http://www.securityfocus.com/bid/101268 | Third Party Advisory, VDB Entry | |
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8113 | Issue Tracking, Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-6935 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/101268 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8113 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-6935 | Issue Tracking, Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "490C796D-2703-4299-B466-44C87938BF7C", versionEndIncluding: "4.4.1", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "40B09403-2209-4C47-A0EB-BDF9236173C6", versionEndIncluding: "4.4.1", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the dialog parameter.", }, { lang: "es", value: "Varios recursos en Atlassian Fisheye y Crucible en versiones anteriores a la 4.4.2 permiten a los atacantes remotos inyectar HTML o JavaScript arbitrarios a través de una vulnerabilidad de cross site scripting (XSS) en el parámetro de diálogo.", }, ], id: "CVE-2017-14588", lastModified: "2024-11-21T03:13:09.543", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, exploitabilityScore: 2.8, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2017-10-11T18:29:00.990", references: [ { source: "security@atlassian.com", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/101268", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8113", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-6935", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/101268", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8113", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-6935", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2020-06-01 07:15
Modified
2024-11-21 05:32
Severity ?
Summary
The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get information about any configured Jira application links via an information disclosure vulnerability.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8470 | Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7286 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8470 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7286 | Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "A9EADFDF-1149-494B-86FA-143FC53BA41E", versionEndExcluding: "4.8.1", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "83C2CA02-E919-49B9-B1D7-EBD4F0A92321", versionEndExcluding: "4.8.1", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get information about any configured Jira application links via an information disclosure vulnerability.", }, { lang: "es", value: "El recurso /rest/jira-ril/1.0/jira-rest/applinks en el plugin crucible-jira-ril en Atlassian Fisheye y Crucible versiones anteriores a 4.8.1, permite a atacantes remotos obtener información sobre cualquiera de los enlaces de aplicación Jira configurados por medio de una vulnerabilidad de divulgación de información.", }, ], id: "CVE-2020-4017", lastModified: "2024-11-21T05:32:09.803", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 5, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 10, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.3, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 1.4, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2020-06-01T07:15:10.860", references: [ { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8470", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7286", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8470", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7286", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "NVD-CWE-noinfo", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2022-03-16 01:15
Modified
2024-11-21 06:30
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and therefore required solving a CAPTCHA in addition to providing user credentials for authentication via a improper restriction of excess authentication attempts vulnerability.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8523 | Issue Tracking, Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7387 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8523 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7387 | Issue Tracking, Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "4D4FEF8B-76B5-4DB1-BC60-FE05BB918444", versionEndExcluding: "4.8.9", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "5C288EF9-2CF5-40F1-BC5E-C4C1EAE30B14", versionEndExcluding: "4.8.9", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and therefore required solving a CAPTCHA in addition to providing user credentials for authentication via a improper restriction of excess authentication attempts vulnerability.", }, { lang: "es", value: "Varios recursos de reposo en Fisheye y Crucible versiones anteriores a 4.8.9 permitían a atacantes remotos forzar las credenciales de inicio de sesión de usuarios, ya que los recursos de reposo no comprobaban si los usuarios estaban más allá de sus límites máximos de inicio de sesión fallido y, por lo tanto, requerían resolver un CAPTCHA además de proporcionar las credenciales de usuario para la autenticación por medio de una vulnerabilidad de restricción inapropiada del exceso de intentos de autenticación", }, ], id: "CVE-2021-43958", lastModified: "2024-11-21T06:30:05.290", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "134c704f-9b21-4f2e-91b3-4a467353bcc0", type: "Secondary", }, ], }, published: "2022-03-16T01:15:07.950", references: [ { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8523", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7387", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8523", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7387", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-307", }, ], source: "nvd@nist.gov", type: "Primary", }, { description: [ { lang: "en", value: "CWE-307", }, ], source: "134c704f-9b21-4f2e-91b3-4a467353bcc0", type: "Secondary", }, ], }
Vulnerability from fkie_nvd
Published
2020-06-01 07:15
Modified
2024-11-21 05:32
Severity ?
Summary
The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get the ID of configured Jira application links via an information disclosure vulnerability.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8469 | Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7285 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8469 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7285 | Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "A9EADFDF-1149-494B-86FA-143FC53BA41E", versionEndExcluding: "4.8.1", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "83C2CA02-E919-49B9-B1D7-EBD4F0A92321", versionEndExcluding: "4.8.1", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get the ID of configured Jira application links via an information disclosure vulnerability.", }, { lang: "es", value: "El recurso /plugins/servlet/jira-blockers/ en el plugin crucible-jira-ril en Atlassian Fisheye y Crucible versiones anteriores a 4.8.1, permite a atacantes remotos obtener el ID de los enlaces de la aplicación Jira configurados por medio de una vulnerabilidad de divulgación de información.", }, ], id: "CVE-2020-4016", lastModified: "2024-11-21T05:32:09.707", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 5, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 10, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.3, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 1.4, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2020-06-01T07:15:10.813", references: [ { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8469", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7285", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8469", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7285", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "NVD-CWE-noinfo", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2017-08-24 17:29
Modified
2024-11-21 03:36
Severity ?
Summary
The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the review filter title parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8043 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8043 | Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "63C32D18-9A27-4D20-A0EA-A44BA2DA9E2E", versionEndIncluding: "4.4.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "BB0CDA4F-731F-4F40-9ED9-496576B93345", versionEndIncluding: "4.4.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the review filter title parameter.", }, { lang: "es", value: "El recurso review dashboard en Atlassian Crucible desde la versión 4.1.0 hasta antes de la versión 4.4.1 permite que atacantes remotos inyecten HTML o JavaScript arbitrario mediante una vulnerabilidad cross-Site Scripting (XSS) en el parámetro review filter title.", }, ], id: "CVE-2017-9507", lastModified: "2024-11-21T03:36:17.567", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "LOW", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 3.5, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:S/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 6.8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.4, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, exploitabilityScore: 2.3, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2017-08-24T17:29:00.240", references: [ { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8043", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8043", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2018-03-29 13:29
Modified
2024-11-21 04:08
Severity ?
Summary
Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible on the Windows operating system. All versions of Fisheye and Crucible before 4.4.6 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.3 (the fixed version for 4.5.x) are affected by this vulnerability.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | http://www.securityfocus.com/bid/103665 | Third Party Advisory, VDB Entry | |
| security@atlassian.com | https://confluence.atlassian.com/x/Zi5sO | Vendor Advisory | |
| security@atlassian.com | https://confluence.atlassian.com/x/aS5sO | Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8181 | Patch, Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7014 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/103665 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://confluence.atlassian.com/x/Zi5sO | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://confluence.atlassian.com/x/aS5sO | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8181 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7014 | Patch, Vendor Advisory |
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "7FC26E23-D7F4-49AB-B1EC-8E7160DC681E", versionEndExcluding: "4.4.6", versionStartIncluding: "4.4.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "A625FE0C-F0DD-417D-A519-3BE7BDBF9A10", versionEndExcluding: "4.5.3", versionStartIncluding: "4.5.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "8DCD7EAE-7D92-4B97-8551-244DA4AD7EA3", versionEndExcluding: "4.4.6", versionStartIncluding: "4.4.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "A59EB601-4C56-45F5-A54B-84C044081076", versionEndExcluding: "4.5.3", versionStartIncluding: "4.5.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible on the Windows operating system. All versions of Fisheye and Crucible before 4.4.6 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.3 (the fixed version for 4.5.x) are affected by this vulnerability.", }, { lang: "es", value: "Fisheye y Crucible no comprobaban correctamente si un URI de repositorio Mercurial configurado contenía valores que el sistema operativo de Windows podría considerar como parámetros de argumento. Un atacante que tenga permiso para añadir un repositorio en Fisheye o Crucible puede ejecutar código de su elección en sistemas que ejecutan una versión vulnerable de Fisheye y Crucible en el sistema operativo Windows. Todas las versiones de Fisheye y Crucible anteriores a la 4.4.6 (la versión corregida para 4.4.x) y desde la 4.5.0 anteriores a la 4.5.3 (la versión corregida para 4.5.x) se han visto afectadas por esta vulnerabilidad.", }, ], id: "CVE-2018-5223", lastModified: "2024-11-21T04:08:22.220", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "PARTIAL", baseScore: 6.5, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:S/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 8, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.2, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, exploitabilityScore: 1.2, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2018-03-29T13:29:00.273", references: [ { source: "security@atlassian.com", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/103665", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://confluence.atlassian.com/x/Zi5sO", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://confluence.atlassian.com/x/aS5sO", }, { source: "security@atlassian.com", tags: [ "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8181", }, { source: "security@atlassian.com", tags: [ "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7014", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/103665", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://confluence.atlassian.com/x/Zi5sO", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://confluence.atlassian.com/x/aS5sO", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8181", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7014", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-20", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2018-02-02 14:29
Modified
2024-11-21 03:19
Severity ?
Summary
The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8161 | Issue Tracking, Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-6994 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8161 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-6994 | Issue Tracking, Vendor Advisory |
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "CC7AF5E6-136F-4DED-823F-602C6863265B", versionEndExcluding: "4.5.1", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crucible:4.6.0:*:*:*:*:*:*:*", matchCriteriaId: "1F48646D-1774-4036-8BBF-3BAA34EF4787", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "557AE134-DC5B-4546-8DF4-1E89BB32558E", versionEndExcluding: "4.5.1", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:4.6.0:*:*:*:*:*:*:*", matchCriteriaId: "5342E75B-39DD-45F5-B794-CB63D7E8894A", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch.", }, { lang: "es", value: "El recurso de exploración de fuentes en Atlassian Fisheye y Crucible en versiones anterores 4.5.1 y 4.6.0 permite a los atacantes remotos que tienen acceso de escritura a un repositorio indexado inyectar HTML o JavaScript arbitrario a través de una vulnerabilidad de scripts de sitios cruzados (XSS) a través de un nombre de rama del repositorio especialmente elaborado cuando se intenta mostrar los archivos eliminados de la rama", }, ], id: "CVE-2017-18034", lastModified: "2024-11-21T03:19:13.000", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "LOW", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 3.5, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:S/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 6.8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.4, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, exploitabilityScore: 2.3, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2018-02-02T14:29:00.543", references: [ { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8161", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-6994", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8161", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-6994", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2021-02-02 00:15
Modified
2024-11-21 05:02
Severity ?
Summary
Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen response header from Atlassian Analytics. The affected versions are before version 4.8.4.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8502 | Issue Tracking, Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7334 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8502 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7334 | Issue Tracking, Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "31A5B1B9-5B8B-4838-97C7-3287A715DA52", versionEndExcluding: "4.8.4", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "5ECD6A49-2A44-4220-97F1-E5D44BAFFF34", versionEndExcluding: "4.8.4", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen response header from Atlassian Analytics. The affected versions are before version 4.8.4.", }, { lang: "es", value: "Las versiones afectadas de Atlassian Fisheye y Crucible, permiten a atacantes remotos visualizar el SEN de un producto por medio de una vulnerabilidad de divulgación de información en el encabezado de respuesta x-asen de Atlassian Analytics. Las versiones afectadas son anteriores a 4.8.4", }, ], id: "CVE-2020-14192", lastModified: "2024-11-21T05:02:50.390", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:S/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.3, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 1.4, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2021-02-02T00:15:12.320", references: [ { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8502", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7334", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8502", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7334", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-200", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2017-08-24 17:29
Modified
2024-11-21 03:36
Severity ?
Summary
The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the start date and end date parameters.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/FE-6890 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-6890 | Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "BB0CDA4F-731F-4F40-9ED9-496576B93345", versionEndIncluding: "4.4.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the start date and end date parameters.", }, { lang: "es", value: "El recurso de registro de cambios en el repositorio en Atlassian Fisheye en versiones anteriores a la 4.4.1 permite que atacantes remotos inyecten HTML o JavaScript arbitrario mediante una vulnerabilidad cross-Site Scripting (XSS a través de los parámetros de fecha de inicio y fecha de finalización", }, ], id: "CVE-2017-9510", lastModified: "2024-11-21T03:36:17.893", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "LOW", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 3.5, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:S/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 6.8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.4, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, exploitabilityScore: 2.3, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2017-08-24T17:29:00.350", references: [ { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-6890", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-6890", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2017-08-24 17:29
Modified
2024-11-21 03:36
Severity ?
Summary
The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8053 | Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-6892 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8053 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-6892 | Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "63C32D18-9A27-4D20-A0EA-A44BA2DA9E2E", versionEndIncluding: "4.4.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "BB0CDA4F-731F-4F40-9ED9-496576B93345", versionEndIncluding: "4.4.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks.", }, { lang: "es", value: "El recurso mostActiveCommitters.do en Atlassian FishEye y Crucible en versiones anteriores a la 4.4.1 permite que atacantes remotos accedan a información sensible, por ejemplo, las direcciones de email de los autores, ya que no cuenta con verificación de permisos", }, ], id: "CVE-2017-9512", lastModified: "2024-11-21T03:36:18.163", metrics: { cvssMetricV2: [ { acInsufInfo: true, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 5, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 10, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.0", }, exploitabilityScore: 3.9, impactScore: 3.6, source: "nvd@nist.gov", type: "Primary", }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 3.6, source: "134c704f-9b21-4f2e-91b3-4a467353bcc0", type: "Secondary", }, ], }, published: "2017-08-24T17:29:00.383", references: [ { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8053", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-6892", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8053", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-6892", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-200", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2018-02-16 18:29
Modified
2024-11-21 03:19
Severity ?
Summary
Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a commit author.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | http://www.securityfocus.com/bid/103076 | Third Party Advisory, VDB Entry | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7000 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/103076 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7000 | Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:fisheye:4.5.0:*:*:*:*:*:*:*", matchCriteriaId: "DC4FA7F3-F6C3-4976-9E2A-2C7A6FE8329D", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a commit author.", }, { lang: "es", value: "Varios recursos en Atlassian Fisheye en versiones anteriores a la 4.5.1 (la versión solucionada para 4.5.x) y en versiones anteriores a la 4.6.0 permiten que atacantes remotos inyecten HTML o JavaScript arbitrario mediante una vulnerabilidad Cross-Site Scripting (XSS) en nombre de un autor de commit.", }, ], id: "CVE-2017-18090", lastModified: "2024-11-21T03:19:20.343", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, exploitabilityScore: 2.8, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2018-02-16T18:29:00.273", references: [ { source: "security@atlassian.com", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/103076", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7000", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/103076", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7000", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2018-09-18 14:29
Modified
2024-11-21 03:47
Severity ?
Summary
The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery (CSRF) vulnerability.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8312 | Third Party Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7100 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8312 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7100 | Third Party Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "6D02D4F4-EFEE-46AE-AB17-9E4D301C4F8F", versionEndExcluding: "4.5.4", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "C5CE4737-58B5-46B8-8105-EFCE414A6A65", versionEndExcluding: "4.5.4", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery (CSRF) vulnerability.", }, { lang: "es", value: "El recurso administrativo smart-commits en Atlassian Fisheye y Crucible en versiones anteriores a la 4.5.4 permite que atacantes remotos modifiquen las opciones de smart-commit mediante una vulnerabilidad Cross-Site Request Forgery (CSRF).", }, ], id: "CVE-2018-13398", lastModified: "2024-11-21T03:47:01.603", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", version: "3.0", }, exploitabilityScore: 2.8, impactScore: 3.6, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2018-09-18T14:29:00.857", references: [ { source: "security@atlassian.com", tags: [ "Third Party Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8312", }, { source: "security@atlassian.com", tags: [ "Third Party Advisory", ], url: "https://jira.atlassian.com/browse/FE-7100", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8312", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "https://jira.atlassian.com/browse/FE-7100", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-352", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2018-02-02 14:29
Modified
2024-11-21 03:19
Severity ?
Summary
The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistics for it.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8163 | Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-6996 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8163 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-6996 | Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "557AE134-DC5B-4546-8DF4-1E89BB32558E", versionEndExcluding: "4.5.1", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "CC7AF5E6-136F-4DED-823F-602C6863265B", versionEndExcluding: "4.5.1", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistics for it.", }, { lang: "es", value: "El recurso /rest/review-coverage-chart/1.0/data//.json en Atlassian Fisheye y Crucible, en versiones anteriores a la 4.5.1 y la 4.6.0, no tenía una comprobación de permisos. Esto permite que atacantes remotos que no tengan acceso a un repositorio en concreto determinen su existencia y accedan a sus estadísticas de cobertura de revisión.", }, ], id: "CVE-2017-18035", lastModified: "2024-11-21T03:19:13.130", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:S/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.3, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", version: "3.0", }, exploitabilityScore: 2.8, impactScore: 1.4, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2018-02-02T14:29:00.607", references: [ { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8163", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-6996", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8163", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-6996", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-284", }, ], source: "security@atlassian.com", type: "Secondary", }, { description: [ { lang: "en", value: "CWE-862", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2018-03-22 13:29
Modified
2024-11-21 03:19
Severity ?
Summary
Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the base path setting of a configured file system repository.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8177 | Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7010 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8177 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7010 | Vendor Advisory |
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "97718354-9B00-4E93-A879-7423456E0344", versionEndExcluding: "4.4.3", versionStartIncluding: "4.4.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:4.5.0:*:*:*:*:*:*:*", matchCriteriaId: "DC4FA7F3-F6C3-4976-9E2A-2C7A6FE8329D", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "C1A5C301-8708-4774-9DC5-717E88A805F0", versionEndExcluding: "4.4.3", versionStartIncluding: "4.4.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crucible:4.5.0:*:*:*:*:*:*:*", matchCriteriaId: "E86BAE07-084C-411C-AAD9-676E8FC50703", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the base path setting of a configured file system repository.", }, { lang: "es", value: "Varios recursos en Atlassian Fisheye y Crucible en versiones anteriores a la 4.4.3 (la versión parcheada para 4.4.x) y 4.5.0 permiten que atacantes remotos con privilegios administrativos inyecten código HTML o JavaScript arbitrario mediante una vulnerabilidad Cross-Site Scripting (XSS) a través de la configuración de ruta base de un repositorio de sistema de archivos configurado.", }, ], id: "CVE-2017-18094", lastModified: "2024-11-21T03:19:20.900", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "LOW", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 3.5, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:S/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 6.8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.8, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "HIGH", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, exploitabilityScore: 1.7, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2018-03-22T13:29:00.217", references: [ { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8177", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7010", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8177", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7010", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2020-08-05 04:15
Modified
2024-11-21 03:19
Severity ?
Summary
Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the logging feature. The affected versions are before version 4.8.3.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7309 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7309 | Issue Tracking, Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "95BF3B44-3024-440E-9231-0F2503ED8C73", versionEndExcluding: "4.8.3", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the logging feature. The affected versions are before version 4.8.3.", }, { lang: "es", value: "Las versiones afectadas de Atlassian Fisheye, permiten a atacantes remotos visualizar la contraseña HTTP de un repositorio por medio de una vulnerabilidad de divulgación de información en la funcionalidad logging. Las versiones afectadas son anteriores a la versión 4.8.3", }, ], id: "CVE-2017-18112", lastModified: "2024-11-21T03:19:23.007", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:S/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 3.6, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2020-08-05T04:15:13.683", references: [ { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7309", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7309", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-200", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2020-11-25 23:15
Modified
2024-11-21 05:02
Severity ?
Summary
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8498 | Issue Tracking, Patch, Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7336 | Issue Tracking, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8498 | Issue Tracking, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7336 | Issue Tracking, Patch, Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "31A5B1B9-5B8B-4838-97C7-3287A715DA52", versionEndExcluding: "4.8.4", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "5ECD6A49-2A44-4220-97F1-E5D44BAFFF34", versionEndExcluding: "4.8.4", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4.", }, { lang: "es", value: "Las versiones afectadas de Atlassian Fisheye/Crucible permiten a atacantes remotos alcanzar una Denegación de Servicio de una Regex por medio de una regex suministrada por el usuario en EyeQL. Las versiones afectadas son las anteriores a 4.8.4", }, ], id: "CVE-2020-14190", lastModified: "2024-11-21T05:02:50.163", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 3.6, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2020-11-25T23:15:11.220", references: [ { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8498", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7336", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8498", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7336", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-400", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2019-12-11 15:15
Modified
2024-11-21 04:27
Severity ?
Summary
The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove another user's favourite setting for a project via an improper authorization vulnerability.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8443 | Issue Tracking, Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7252 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8443 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7252 | Issue Tracking, Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "2B7F1CDC-7EE5-450F-B319-EFC16053762F", versionEndExcluding: "4.8.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "AC25B648-7C96-49F3-866D-EAE4C13BE6D9", versionEndExcluding: "4.8.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove another user's favourite setting for a project via an improper authorization vulnerability.", }, { lang: "es", value: "El recurso /json/profile/removeStarAjax.do en Atlassian Fisheye and Crucible versiones anteriores a 4.8.0, permite a atacantes remotos suprimir la configuración favorita de otro usuario para un proyecto por medio de una vulnerabilidad de autorización inapropiada.", }, ], id: "CVE-2019-15009", lastModified: "2024-11-21T04:27:51.950", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:S/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.3, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 1.4, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2019-12-11T15:15:14.573", references: [ { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8443", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7252", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8443", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7252", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "NVD-CWE-noinfo", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2017-10-11 18:29
Modified
2024-11-21 03:13
Severity ?
Summary
The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | http://www.securityfocus.com/bid/101266 | Third Party Advisory, VDB Entry | |
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8112 | Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-6933 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/101266 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8112 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-6933 | Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "490C796D-2703-4299-B466-44C87938BF7C", versionEndIncluding: "4.4.1", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "40B09403-2209-4C47-A0EB-BDF9236173C6", versionEndIncluding: "4.4.1", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter.", }, { lang: "es", value: "El recurso de borrado de usuarios de administración en Atlassian Fisheye y Crucible en versiones anteriores a la 4.4.2 permite a los atacantes remotos inyectar HTML o JavaScript arbitrarios a través de una vulnerabilidad de Cross-Site Scripting (XSS) en el parámetro uname", }, ], id: "CVE-2017-14587", lastModified: "2024-11-21T03:13:09.430", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "LOW", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 3.5, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:S/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 6.8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.4, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, exploitabilityScore: 2.3, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2017-10-11T18:29:00.800", references: [ { source: "security@atlassian.com", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/101266", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8112", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-6933", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/101266", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8112", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-6933", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2020-06-01 07:15
Modified
2024-11-21 05:32
Severity ?
Summary
The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a information disclosure vulnerability.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8468 | Third Party Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7284 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8468 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7284 | Third Party Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "A9EADFDF-1149-494B-86FA-143FC53BA41E", versionEndExcluding: "4.8.1", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "83C2CA02-E919-49B9-B1D7-EBD4F0A92321", versionEndExcluding: "4.8.1", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a information disclosure vulnerability.", }, { lang: "es", value: "El recurso /json/fe/activeUserFinder.do en Atlassian Fisheye y Crucible versiones anteriores a 4.8.1, permite a atacantes remotos visualizar las direcciones de correo electrónico de los usuarios por medio de una vulnerabilidad de divulgación de información.", }, ], id: "CVE-2020-4015", lastModified: "2024-11-21T05:32:09.607", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:S/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.3, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 1.4, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2020-06-01T07:15:10.750", references: [ { source: "security@atlassian.com", tags: [ "Third Party Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8468", }, { source: "security@atlassian.com", tags: [ "Third Party Advisory", ], url: "https://jira.atlassian.com/browse/FE-7284", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8468", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "https://jira.atlassian.com/browse/FE-7284", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "NVD-CWE-noinfo", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2022-03-16 01:15
Modified
2024-11-21 06:30
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8524 | Issue Tracking, Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7388 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8524 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7388 | Issue Tracking, Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "4D4FEF8B-76B5-4DB1-BC60-FE05BB918444", versionEndExcluding: "4.8.9", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "5C288EF9-2CF5-40F1-BC5E-C4C1EAE30B14", versionEndExcluding: "4.8.9", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9.", }, { lang: "es", value: "Las versiones afectadas de Atlassian Fisheye y Crucible permitían a atacantes remotos navegar por archivos locales por medio de una vulnerabilidad de Insecure Direct Object References (IDOR) en el directorio WEB-INF y omitir la corrección de CVE-2020-29446 debido a una falta de decodificación de url. Las versiones afectadas son anteriores a la versión 4.8.9", }, ], id: "CVE-2021-43957", lastModified: "2024-11-21T06:30:05.067", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 5, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 10, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 3.6, source: "nvd@nist.gov", type: "Primary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 3.6, source: "134c704f-9b21-4f2e-91b3-4a467353bcc0", type: "Secondary", }, ], }, published: "2022-03-16T01:15:07.877", references: [ { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8524", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7388", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8524", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7388", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-639", }, ], source: "nvd@nist.gov", type: "Primary", }, { description: [ { lang: "en", value: "CWE-639", }, ], source: "134c704f-9b21-4f2e-91b3-4a467353bcc0", type: "Secondary", }, ], }
Vulnerability from fkie_nvd
Published
2017-08-24 17:29
Modified
2024-11-21 03:36
Severity ?
Summary
Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a repository or review file.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8044 | Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-6898 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8044 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-6898 | Vendor Advisory |
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:4.3.1:*:*:*:*:*:*:*", matchCriteriaId: "9BA71640-8570-4FE1-939C-3B58FB991AA8", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crucible:4.4.0:*:*:*:*:*:*:*", matchCriteriaId: "4313BC7C-73BF-407B-9437-90717C4E4AF4", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:4.3.1:*:*:*:*:*:*:*", matchCriteriaId: "882B8E34-5BA2-4314-B550-C8A72E8F5ED2", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:4.4.0:*:*:*:*:*:*:*", matchCriteriaId: "594DD2B1-F553-4121-ADDF-D639E7F53426", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a repository or review file.", }, { lang: "es", value: "Varios recursos en Atlassian FishEye y Crucible en versiones anteriores a la 4.4.1 permiten que atacantes remotos inyecten HTML o JavaScript arbitrario mediante una vulnerabilidad cross-Site Scripting (XSS) mediante el nombre de un archivo de repositorio o de revisión", }, ], id: "CVE-2017-9508", lastModified: "2024-11-21T03:36:17.687", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "LOW", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 3.5, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:S/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 6.8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.4, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, exploitabilityScore: 2.3, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2017-08-24T17:29:00.273", references: [ { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8044", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-6898", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8044", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-6898", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2018-07-10 13:29
Modified
2024-11-21 03:47
Severity ?
Summary
The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in attached files.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | http://www.securityfocus.com/bid/104717 | Third Party Advisory, VDB Entry | |
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8209 | Issue Tracking, Patch, Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7059 | Issue Tracking, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/104717 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8209 | Issue Tracking, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7059 | Issue Tracking, Patch, Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "03081646-61D4-469C-A3C0-500411C90036", versionEndExcluding: "4.5.3", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "839FEB4F-7E61-4445-9376-4679504F84A5", versionEndExcluding: "4.5.3", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in attached files.", }, { lang: "es", value: "El recurso review attachment en Atlassian FishEye y Crucible, en versiones anteriores a la 4.5.3, permiten que atacantes remotos inyecten HTML o JavaScript arbitrario mediante una vulnerabilidad Cross-Site Scripting (XSS) en los archivos adjuntos.", }, ], id: "CVE-2018-13388", lastModified: "2024-11-21T03:47:00.437", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "LOW", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 3.5, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:S/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 6.8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.4, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, exploitabilityScore: 2.3, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2018-07-10T13:29:00.480", references: [ { source: "security@atlassian.com", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/104717", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8209", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7059", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/104717", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8209", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7059", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2020-06-01 07:15
Modified
2024-11-21 05:32
Severity ?
Summary
The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's watching settings for a repository via an improper authorization vulnerability.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8467 | Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7283 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8467 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7283 | Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "A9EADFDF-1149-494B-86FA-143FC53BA41E", versionEndExcluding: "4.8.1", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "83C2CA02-E919-49B9-B1D7-EBD4F0A92321", versionEndExcluding: "4.8.1", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's watching settings for a repository via an improper authorization vulnerability.", }, { lang: "es", value: "El recurso /profile/deleteWatch.do en Atlassian Fisheye y Crucible versiones anteriores a 4.8.1, permite a atacantes remotos eliminar la configuración de vigilancia de otro usuario para un repositorio por medio de una vulnerabilidad de autorización inapropiada.", }, ], id: "CVE-2020-4014", lastModified: "2024-11-21T05:32:09.510", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:S/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.3, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 1.4, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2020-06-01T07:15:10.673", references: [ { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8467", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7283", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8467", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7283", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "NVD-CWE-noinfo", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2019-02-20 14:29
Modified
2024-11-21 04:01
Severity ?
Summary
The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | http://www.securityfocus.com/bid/107128 | Third Party Advisory, VDB Entry | |
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8381 | Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7163 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/107128 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8381 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7163 | Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "5C140AB4-C751-4D25-B1E7-BC1729D25B4D", versionEndExcluding: "4.7.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "40DD6225-F761-4E32-B6E9-45A9C79D4AD2", versionEndExcluding: "4.7.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter.", }, { lang: "es", value: "La funcionalidad de enlazador administrativo en Atlassian FishEye y Crucible, en versiones anteriores a la 4.7.0, permite que atacantes remotos inyecten HTML o JavaScript arbitrarios mediante una vulnerabilidad Cross-Site Scripting (XSS) en el parámetro href.", }, ], id: "CVE-2018-20240", lastModified: "2024-11-21T04:01:08.987", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "LOW", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 3.5, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:S/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 6.8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.8, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "HIGH", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, exploitabilityScore: 1.7, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2019-02-20T14:29:00.247", references: [ { source: "security@atlassian.com", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/107128", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8381", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7163", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/107128", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8381", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7163", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2019-12-11 15:15
Modified
2024-11-21 04:27
Severity ?
Summary
The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a missing branch.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8439 | Issue Tracking, Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7250 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8439 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7250 | Issue Tracking, Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "29546385-66E3-4353-B314-7CBE6AF06775", versionEndExcluding: "4.7.3", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "3C591C4E-A934-49B0-AF8A-AFFF7ADDD4CF", versionEndExcluding: "4.7.3", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a missing branch.", }, { lang: "es", value: "El recurso de revisión en Atlassian Fisheye and Crucible versiones anteriores a 4.7.3, permite a atacantes remotos inyectar HTML o JavaScript arbitrario por medio de una vulnerabilidad de tipo cross-site scripting (XSS) por medio del nombre de una ramificación que falta.", }, ], id: "CVE-2019-15007", lastModified: "2024-11-21T04:27:51.740", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "LOW", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 3.5, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:S/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 6.8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.8, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "HIGH", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, exploitabilityScore: 1.7, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2019-12-11T15:15:14.387", references: [ { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8439", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7250", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8439", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7250", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2018-06-28 14:29
Modified
2024-11-21 03:17
Severity ?
Summary
The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | http://www.securityfocus.com/bid/104578 | Third Party Advisory, VDB Entry | |
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8212 | Issue Tracking, Third Party Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7061 | Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/104578 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8212 | Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7061 | Issue Tracking, Third Party Advisory |
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "236344F6-D714-4CBB-A741-7492ED0C1034", versionEndExcluding: "4.3.2", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "C1A5C301-8708-4774-9DC5-717E88A805F0", versionEndExcluding: "4.4.3", versionStartIncluding: "4.4.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "6ECAA854-F8F5-443C-BA81-428CE40C0E4A", versionEndExcluding: "4.5.0", versionStartIncluding: "4.4.5", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "AD4FFE7E-3037-4CA3-86D6-89087986840C", versionEndExcluding: "4.3.2", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "97718354-9B00-4E93-A879-7423456E0344", versionEndExcluding: "4.4.3", versionStartIncluding: "4.4.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "57504A18-A951-40C9-A2A9-994298B806E4", versionEndExcluding: "4.5.0", versionStartIncluding: "4.4.5", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parameter.", }, { lang: "es", value: "El recurso review attachment en Atlassian Fisheye y Crucible en versiones anteriores a la 4.3.2, desde la 4.4.0 hasta la 4.4.3 y en versiones anteriores a la 4.5.0 permite que los atacantes remotos lean archivos contenidos en la ruta context de la aplicación en ejecución mediante una vulnerabilidad de salto de directorio en el parámetro command.", }, ], id: "CVE-2017-16859", lastModified: "2024-11-21T03:17:06.973", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:S/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.0", }, exploitabilityScore: 2.8, impactScore: 3.6, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2018-06-28T14:29:00.213", references: [ { source: "security@atlassian.com", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/104578", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Third Party Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8212", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Third Party Advisory", ], url: "https://jira.atlassian.com/browse/FE-7061", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/104578", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Third Party Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8212", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Third Party Advisory", ], url: "https://jira.atlassian.com/browse/FE-7061", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-22", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2020-06-01 07:15
Modified
2024-11-21 05:32
Severity ?
Summary
The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the review objectives.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8466 | Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7282 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8466 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7282 | Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "A9EADFDF-1149-494B-86FA-143FC53BA41E", versionEndExcluding: "4.8.1", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "83C2CA02-E919-49B9-B1D7-EBD4F0A92321", versionEndExcluding: "4.8.1", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the review objectives.", }, { lang: "es", value: "El recurso de revisión en Atlassian Fisheye y Crucible versiones anteriores a 4.8.1, permite a atacantes remotos inyectar HTML o Javascript arbitrarios por medio de una vulnerabilidad de tipo cross site scripting (XSS) por medio de los objetivos de revisión.", }, ], id: "CVE-2020-4013", lastModified: "2024-11-21T05:32:09.397", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "LOW", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 3.5, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:S/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 6.8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.4, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, exploitabilityScore: 2.3, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2020-06-01T07:15:10.517", references: [ { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8466", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7282", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8466", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7282", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2018-04-24 12:29
Modified
2024-11-21 04:08
Severity ?
Summary
The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | http://www.securityfocus.com/bid/104006 | Third Party Advisory, VDB Entry | |
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8201 | Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7035 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/104006 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8201 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7035 | Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "839FEB4F-7E61-4445-9376-4679504F84A5", versionEndExcluding: "4.5.3", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "03081646-61D4-469C-A3C0-500411C90036", versionEndExcluding: "4.5.3", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers.", }, { lang: "es", value: "El recurso /browse/~raw en Atlassian FishEye y Crucible, en versiones anteriores a la 4.5.3, permite que atacantes remotos inyecten HTML o JavaScript arbitrario mediante una vulnerabilidad Cross-Site Scripting (XSS) en la gestión de cabeceras de respuesta.", }, ], id: "CVE-2018-5228", lastModified: "2024-11-21T04:08:22.870", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, exploitabilityScore: 2.8, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2018-04-24T12:29:00.473", references: [ { source: "security@atlassian.com", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/104006", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8201", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7035", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/104006", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8201", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7035", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2022-03-16 01:15
Modified
2024-11-21 06:30
Severity ?
Summary
The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about installation directories via information disclosure vulnerability.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8533 | Issue Tracking, Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7397 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8533 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7397 | Issue Tracking, Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "4D4FEF8B-76B5-4DB1-BC60-FE05BB918444", versionEndExcluding: "4.8.9", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "5C288EF9-2CF5-40F1-BC5E-C4C1EAE30B14", versionEndExcluding: "4.8.9", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about installation directories via information disclosure vulnerability.", }, { lang: "es", value: "El recurso /rest-service-fecru/server-v1 en Fisheye y Crucible versiones anteriores a 4.8.9, permitía a atacantes remotos autenticados obtener información sobre los directorios de instalación por medio de una vulnerabilidad de divulgación de información", }, ], id: "CVE-2021-43955", lastModified: "2024-11-21T06:30:04.810", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:S/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.3, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 1.4, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2022-03-16T01:15:07.607", references: [ { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8533", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7397", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8533", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7397", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "NVD-CWE-noinfo", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2021-01-18 02:15
Modified
2024-11-21 05:24
Severity ?
Summary
Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory. The affected versions are before version 4.8.5.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8496 | Issue Tracking, Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7326 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8496 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7326 | Issue Tracking, Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "8E61BF67-BA8A-4E07-8B8F-BB6C84EEA528", versionEndExcluding: "4.8.5", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "78C94E9F-5F71-4A6B-9745-CDDEC426BDC7", versionEndExcluding: "4.8.5", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory. The affected versions are before version 4.8.5.", }, { lang: "es", value: "Las versiones afectadas de Atlassian Fisheye & Crucible permiten a los atacantes remotos navegar por los archivos locales a través de una vulnerabilidad de Insecure Direct Object References (IDOR) en el directorio WEB-INF. Las versiones afectadas son anteriores a la versión 4.8.5", }, ], id: "CVE-2020-29446", lastModified: "2024-11-21T05:24:01.307", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 5, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 10, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.3, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 1.4, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2021-01-18T02:15:13.393", references: [ { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8496", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7326", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8496", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7326", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-639", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2022-03-14 02:15
Modified
2024-11-21 06:30
Severity ?
Summary
The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8520 | Issue Tracking, Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7384 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8520 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7384 | Issue Tracking, Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "4D4FEF8B-76B5-4DB1-BC60-FE05BB918444", versionEndExcluding: "4.8.9", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "5C288EF9-2CF5-40F1-BC5E-C4C1EAE30B14", versionEndExcluding: "4.8.9", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.", }, { lang: "es", value: "La clase DefaultRepositoryAdminService en Fisheye and Crucible versiones anteriores a 4.8.9, permitía a atacantes remotos, que tuvieran el permiso \"can add repository permission\", enumerar la existencia de recursos internos de red y del sistema de archivos por medio de una vulnerabilidad de tipo Server-Side Request Forgery (SSRF)", }, ], id: "CVE-2021-43954", lastModified: "2024-11-21T06:30:04.690", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:S/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.3, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 1.4, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2022-03-14T02:15:08.197", references: [ { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8520", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7384", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8520", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7384", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-918", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2017-08-24 18:29
Modified
2024-11-21 03:36
Severity ?
Summary
The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating system.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8049 | Issue Tracking, VDB Entry, Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-6891 | Issue Tracking, VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8049 | Issue Tracking, VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-6891 | Issue Tracking, VDB Entry, Vendor Advisory |
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "63C32D18-9A27-4D20-A0EA-A44BA2DA9E2E", versionEndIncluding: "4.4.0", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "BB0CDA4F-731F-4F40-9ED9-496576B93345", versionEndIncluding: "4.4.0", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", matchCriteriaId: "A2572D17-1DE6-457B-99CC-64AFD54487EA", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating system.", }, { lang: "es", value: "La clase MultiPathResource en Atlassian FishEye y Crucible en versiones anteriores a la 4.4.1 permite que atacantes anónimos remotos lean archivos arbitrarios mediante una vulnerabilidad de salto de directorio cuando FishEye o Crucible se ejecutan en el sistema operativo Microsoft Windows", }, ], id: "CVE-2017-9511", lastModified: "2024-11-21T03:36:17.997", metrics: { cvssMetricV2: [ { acInsufInfo: true, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 5, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 10, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.0", }, exploitabilityScore: 3.9, impactScore: 3.6, source: "nvd@nist.gov", type: "Primary", }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 3.6, source: "134c704f-9b21-4f2e-91b3-4a467353bcc0", type: "Secondary", }, ], }, published: "2017-08-24T18:29:00.240", references: [ { source: "security@atlassian.com", tags: [ "Issue Tracking", "VDB Entry", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8049", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "VDB Entry", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-6891", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "VDB Entry", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8049", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "VDB Entry", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-6891", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-22", }, ], source: "nvd@nist.gov", type: "Primary", }, { description: [ { lang: "en", value: "CWE-22", }, ], source: "134c704f-9b21-4f2e-91b3-4a467353bcc0", type: "Secondary", }, ], }
Vulnerability from fkie_nvd
Published
2018-02-01 04:29
Modified
2024-11-21 03:17
Severity ?
Summary
It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fisheye or Crucible or who hosts a website that a user who can access the web interface of Fisheye or Crucible visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Fisheye or Crucible. All versions of Fisheye and Crucible before 4.4.5 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.2 (the fixed version for 4.5.x) are affected by this vulnerability.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | http://www.securityfocus.com/bid/102971 | Third Party Advisory, VDB Entry | |
| security@atlassian.com | https://confluence.atlassian.com/x/h-QyO | Vendor Advisory | |
| security@atlassian.com | https://confluence.atlassian.com/x/iPQyO | Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8156 | Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-6991 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/102971 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://confluence.atlassian.com/x/h-QyO | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://confluence.atlassian.com/x/iPQyO | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8156 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-6991 | Vendor Advisory |
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "3A314B49-7DF6-4DB6-A328-F00526C8686A", versionEndExcluding: "4.4.5", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "65CA77B1-0C10-45F6-BF53-C039A7389807", versionEndExcluding: "4.5.2", versionStartIncluding: "4.5.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "8010121E-62EF-46BC-BAEC-F82B007DC42E", versionEndExcluding: "4.4.5", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "74781603-2B1A-462A-9053-604320A63CB3", versionEndExcluding: "4.5.2", versionStartIncluding: "4.5.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fisheye or Crucible or who hosts a website that a user who can access the web interface of Fisheye or Crucible visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Fisheye or Crucible. All versions of Fisheye and Crucible before 4.4.5 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.2 (the fixed version for 4.5.x) are affected by this vulnerability.", }, { lang: "es", value: "La doble evaluación OGNL era posible en algunas acciones de redirección y en la URL WebWork y las etiquetas Anchor de archivos JSP. Un atacante que pueda acceder a la interfaz web de Fisheye o Crucible o que aloje un sitio web que visite un usuario que pueda acceder a la interfaz web de Fisheye o Crucible puede explotar esta vulnerabilidad para ejecutar código Java a voluntad en sistemas que ejecuten una versión vulnerable de Fisheye o de Crucible. Todas las versiones de Fisheye y Crucible anteriores a la 4.4.5 (la versión corregida para 4.4.x) y desde la 4.5.0 anteriores a la 4.5.2 (la versión corregida para 4.5.x) se han visto afectadas por esta vulnerabilidad.", }, ], id: "CVE-2017-16861", lastModified: "2024-11-21T03:17:07.213", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2018-02-01T04:29:00.373", references: [ { source: "security@atlassian.com", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/102971", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://confluence.atlassian.com/x/h-QyO", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://confluence.atlassian.com/x/iPQyO", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8156", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-6991", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/102971", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://confluence.atlassian.com/x/h-QyO", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://confluence.atlassian.com/x/iPQyO", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8156", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-6991", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "NVD-CWE-noinfo", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2020-06-01 07:15
Modified
2024-11-21 05:32
Severity ?
Summary
The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgery (CSRF) vulnerability.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8471 | Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7287 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8471 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7287 | Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "A9EADFDF-1149-494B-86FA-143FC53BA41E", versionEndExcluding: "4.8.1", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "83C2CA02-E919-49B9-B1D7-EBD4F0A92321", versionEndExcluding: "4.8.1", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgery (CSRF) vulnerability.", }, { lang: "es", value: "Los recursos de configuración en Atlassian Fisheye y Crucible versiones anteriores a 4.8.1, permiten a atacantes remotos completar el proceso de configuración por medio de una vulnerabilidad de tipo cross-site request forgery (CSRF).", }, ], id: "CVE-2020-4018", lastModified: "2024-11-21T05:32:09.913", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 6.8, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2020-06-01T07:15:10.923", references: [ { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8471", }, { source: "security@atlassian.com", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7287", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8471", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7287", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-352", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2022-03-16 01:15
Modified
2024-11-21 06:30
Severity ?
Summary
The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnerability.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@atlassian.com | https://jira.atlassian.com/browse/CRUC-8531 | Issue Tracking, Vendor Advisory | |
| security@atlassian.com | https://jira.atlassian.com/browse/FE-7395 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/CRUC-8531 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jira.atlassian.com/browse/FE-7395 | Issue Tracking, Vendor Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", matchCriteriaId: "4D4FEF8B-76B5-4DB1-BC60-FE05BB918444", versionEndExcluding: "4.8.9", vulnerable: true, }, { criteria: "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", matchCriteriaId: "5C288EF9-2CF5-40F1-BC5E-C4C1EAE30B14", versionEndExcluding: "4.8.9", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnerability.", }, { lang: "es", value: "La biblioteca jQuery deserialize en Fisheye y Crucible versiones anteriores a 4.8.9, permitía a atacantes remotos inyectar HTML y/o JavaScript arbitrario por medio de una vulnerabilidad de contaminación de prototipos", }, ], id: "CVE-2021-43956", lastModified: "2024-11-21T06:30:04.940", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2022-03-16T01:15:07.787", references: [ { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8531", }, { source: "security@atlassian.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7395", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/CRUC-8531", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://jira.atlassian.com/browse/FE-7395", }, ], sourceIdentifier: "security@atlassian.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-1321", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
cve-2017-9511
Vulnerability from cvelistv5
Published
2017-08-24 18:00
Modified
2024-10-15 19:18
Severity ?
EPSS score ?
Summary
The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating system.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/CRUC-8049 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/FE-6891 | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Atlassian Fisheye and Crucible |
Version: All versions prior to version 4.4.1 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T17:11:01.691Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8049", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-6891", }, ], title: "CVE Program Container", }, { affected: [ { cpes: [ "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "fisheye", vendor: "atlassian", versions: [ { lessThan: "4.4.1", status: "affected", version: "0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "crucible", vendor: "atlassian", versions: [ { lessThan: "4.4.1", status: "affected", version: "0", versionType: "custom", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, }, { other: { content: { id: "CVE-2017-9511", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-15T19:16:41.216703Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-22", description: "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-10-15T19:18:49.770Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "Atlassian Fisheye and Crucible", vendor: "Atlassian", versions: [ { status: "affected", version: "All versions prior to version 4.4.1", }, ], }, ], datePublic: "2017-07-17T00:00:00", descriptions: [ { lang: "en", value: "The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating system.", }, ], problemTypes: [ { descriptions: [ { description: "Path Traversal", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-11-25T13:56:32", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8049", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-6891", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2017-07-17T00:00:00", ID: "CVE-2017-9511", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Atlassian Fisheye and Crucible", version: { version_data: [ { version_value: "All versions prior to version 4.4.1", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating system.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Path Traversal", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/CRUC-8049", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8049", }, { name: "https://jira.atlassian.com/browse/FE-6891", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-6891", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2017-9511", datePublished: "2017-08-24T18:00:00Z", dateReserved: "2017-06-07T00:00:00", dateUpdated: "2024-10-15T19:18:49.770Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2021-43955
Vulnerability from cvelistv5
Published
2022-03-16 00:55
Modified
2024-10-03 14:32
Severity ?
EPSS score ?
Summary
The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about installation directories via information disclosure vulnerability.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7397 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CRUC-8533 | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T04:10:16.302Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7397", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8533", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2021-43955", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-03T14:31:59.960541Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-03T14:32:10.648Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.9", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.9", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2022-03-14T00:00:00", descriptions: [ { lang: "en", value: "The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about installation directories via information disclosure vulnerability.", }, ], problemTypes: [ { descriptions: [ { description: "Information Disclosure", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2022-03-16T00:55:15", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7397", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8533", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2022-03-14T00:00:00", ID: "CVE-2021-43955", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.9", }, ], }, }, { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.9", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about installation directories via information disclosure vulnerability.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Information Disclosure", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7397", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7397", }, { name: "https://jira.atlassian.com/browse/CRUC-8533", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8533", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2021-43955", datePublished: "2022-03-16T00:55:15.263201Z", dateReserved: "2021-11-16T00:00:00", dateUpdated: "2024-10-03T14:32:10.648Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2017-18091
Vulnerability from cvelistv5
Published
2018-02-16 18:00
Modified
2024-09-16 20:22
Severity ?
EPSS score ?
Summary
The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7006 | x_refsource_CONFIRM | |
| https://jira.atlassian.com/browse/CRUC-8173 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/103079 | vdb-entry, x_refsource_BID |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Fisheye and Crucible |
Version: prior to 4.4.3 Version: prior to 4.5.0 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T21:13:47.482Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7006", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8173", }, { name: "103079", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/103079", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye and Crucible", vendor: "Atlassian", versions: [ { status: "affected", version: "prior to 4.4.3", }, { status: "affected", version: "prior to 4.5.0", }, ], }, ], datePublic: "2018-02-16T00:00:00", descriptions: [ { lang: "en", value: "The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2018-02-21T10:57:01", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/FE-7006", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/CRUC-8173", }, { name: "103079", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/103079", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2018-02-16T00:00:00", ID: "CVE-2017-18091", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye and Crucible", version: { version_data: [ { version_value: "prior to 4.4.3", }, { version_value: "prior to 4.5.0", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7006", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/FE-7006", }, { name: "https://jira.atlassian.com/browse/CRUC-8173", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/CRUC-8173", }, { name: "103079", refsource: "BID", url: "http://www.securityfocus.com/bid/103079", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2017-18091", datePublished: "2018-02-16T18:00:00Z", dateReserved: "2018-02-01T00:00:00", dateUpdated: "2024-09-16T20:22:54.697Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2017-14587
Vulnerability from cvelistv5
Published
2017-10-11 18:00
Modified
2024-09-17 01:55
Severity ?
EPSS score ?
Summary
The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/101266 | vdb-entry, x_refsource_BID | |
| https://jira.atlassian.com/browse/CRUC-8112 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/FE-6933 | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Atlassian Fisheye and Crucible |
Version: All versions prior to version 4.4.2 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T19:34:38.622Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "101266", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/101266", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8112", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-6933", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Atlassian Fisheye and Crucible", vendor: "Atlassian", versions: [ { status: "affected", version: "All versions prior to version 4.4.2", }, ], }, ], datePublic: "2017-10-10T00:00:00", descriptions: [ { lang: "en", value: "The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-11-25T13:56:32", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { name: "101266", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/101266", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8112", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-6933", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2017-10-10T00:00:00", ID: "CVE-2017-14587", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Atlassian Fisheye and Crucible", version: { version_data: [ { version_value: "All versions prior to version 4.4.2", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "101266", refsource: "BID", url: "http://www.securityfocus.com/bid/101266", }, { name: "https://jira.atlassian.com/browse/CRUC-8112", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8112", }, { name: "https://jira.atlassian.com/browse/FE-6933", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-6933", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2017-14587", datePublished: "2017-10-11T18:00:00Z", dateReserved: "2017-09-19T00:00:00", dateUpdated: "2024-09-17T01:55:33.174Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2017-18035
Vulnerability from cvelistv5
Published
2018-02-02 14:00
Modified
2024-09-16 23:30
Severity ?
EPSS score ?
Summary
The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistics for it.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-6996 | x_refsource_CONFIRM | |
| https://jira.atlassian.com/browse/CRUC-8163 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Fisheye and Crucible |
Version: prior to 4.5.1 and 4.6.0 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T21:06:50.140Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-6996", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8163", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye and Crucible", vendor: "Atlassian", versions: [ { status: "affected", version: "prior to 4.5.1 and 4.6.0", }, ], }, ], datePublic: "2018-01-18T00:00:00", descriptions: [ { lang: "en", value: "The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistics for it.", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-284", description: "Improper Access Control (CWE-284)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2018-02-02T13:57:01", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/FE-6996", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/CRUC-8163", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2018-01-18T00:00:00", ID: "CVE-2017-18035", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye and Crucible", version: { version_data: [ { version_value: "prior to 4.5.1 and 4.6.0", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistics for it.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Improper Access Control (CWE-284)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-6996", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/FE-6996", }, { name: "https://jira.atlassian.com/browse/CRUC-8163", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/CRUC-8163", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2017-18035", datePublished: "2018-02-02T14:00:00Z", dateReserved: "2018-01-17T00:00:00", dateUpdated: "2024-09-16T23:30:24.222Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2017-18094
Vulnerability from cvelistv5
Published
2018-03-22 13:00
Modified
2024-09-16 18:28
Severity ?
EPSS score ?
Summary
Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the base path setting of a configured file system repository.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7010 | x_refsource_CONFIRM | |
| https://jira.atlassian.com/browse/CRUC-8177 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Fisheye and Crucible |
Version: prior to 4.4.3 Version: prior to 4.5.0 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T21:13:48.168Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7010", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8177", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye and Crucible", vendor: "Atlassian", versions: [ { status: "affected", version: "prior to 4.4.3", }, { status: "affected", version: "prior to 4.5.0", }, ], }, ], datePublic: "2018-02-19T00:00:00", descriptions: [ { lang: "en", value: "Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the base path setting of a configured file system repository.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2018-03-22T12:57:01", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/FE-7010", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/CRUC-8177", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2018-02-19T00:00:00", ID: "CVE-2017-18094", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye and Crucible", version: { version_data: [ { version_value: "prior to 4.4.3", }, { version_value: "prior to 4.5.0", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the base path setting of a configured file system repository.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7010", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/FE-7010", }, { name: "https://jira.atlassian.com/browse/CRUC-8177", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/CRUC-8177", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2017-18094", datePublished: "2018-03-22T13:00:00Z", dateReserved: "2018-02-01T00:00:00", dateUpdated: "2024-09-16T18:28:38.668Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2022-26137
Vulnerability from cvelistv5
Published
2022-07-20 17:25
Modified
2024-10-03 17:10
Severity ?
EPSS score ?
Summary
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/BAM-21795 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/BSERV-13370 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CONFSERVER-79476 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CWD-5815 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/FE-7410 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CRUC-8541 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/JRASERVER-73897 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/JSDSERVER-11863 | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Atlassian | Bamboo Server |
Version: unspecified < 8.0.9 Version: 8.1.0 < unspecified Version: unspecified < 8.1.8 Version: 8.2.0 < unspecified Version: unspecified < 8.2.4 |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-03T04:56:37.614Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/BAM-21795", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/BSERV-13370", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CONFSERVER-79476", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CWD-5815", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7410", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8541", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/JRASERVER-73897", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/JSDSERVER-11863", }, ], title: "CVE Program Container", }, { affected: [ { cpes: [ "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "bamboo", vendor: "atlassian", versions: [ { lessThan: "7.2.10", status: "affected", version: "7.2.0", versionType: "custom", }, { lessThan: "8.0.9", status: "affected", version: "8.0.0", versionType: "custom", }, { lessThan: "8.1.8", status: "affected", version: "8.1.0", versionType: "custom", }, { lessThan: "8.2.4", status: "affected", version: "8.2.0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "bitbucket", vendor: "atlassian", versions: [ { lessThan: "7.6.16", status: "affected", version: "0", versionType: "custom", }, { lessThan: "7.17.8", status: "affected", version: "7.7.0", versionType: "custom", }, { lessThan: "7.19.5", status: "affected", version: "7.18.0", versionType: "custom", }, { lessThan: "7.20.2", status: "affected", version: "7.20.1", versionType: "custom", }, { lessThan: "7.21.2", status: "affected", version: "7.21.0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:bitbucket:8.0.0:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "bitbucket", vendor: "atlassian", versions: [ { status: "affected", version: "8.0.0", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:bitbucket:8.1.0:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "bitbucket", vendor: "atlassian", versions: [ { status: "affected", version: "8.1.0", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "confluence_data_center", vendor: "atlassian", versions: [ { lessThan: "7.4.17", status: "affected", version: "0", versionType: "custom", }, { lessThan: "7.13.7", status: "affected", version: "7.5.0", versionType: "custom", }, { lessThan: "7.14.3", status: "affected", version: "7.14.0", versionType: "custom", }, { lessThan: "7.15.2", status: "affected", version: "7.15.0", versionType: "custom", }, { lessThan: "7.16.4", status: "affected", version: "7.16.0", versionType: "custom", }, { lessThan: "7.17.4", status: "affected", version: "7.17.0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:confluence_data_center:7.18.0:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "confluence_data_center", vendor: "atlassian", versions: [ { status: "affected", version: "7.18.0", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "confluence_server", vendor: "atlassian", versions: [ { lessThan: "7.4.17", status: "affected", version: "0", versionType: "custom", }, { lessThan: "7.13.7", status: "affected", version: "7.5.0", versionType: "custom", }, { lessThan: "7.14.3", status: "affected", version: "7.14.0", versionType: "custom", }, { lessThan: "7.15.2", status: "affected", version: "7.15.0", versionType: "custom", }, { lessThan: "7.16.4", status: "affected", version: "7.16.0", versionType: "custom", }, { lessThan: "7.17.4", status: "affected", version: "7.17.0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:confluence_server:7.18.0:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "confluence_server", vendor: "atlassian", versions: [ { status: "affected", version: "7.18.0", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "crowd", vendor: "atlassian", versions: [ { lessThan: "4.3.8", status: "affected", version: "0", versionType: "custom", }, { lessThan: "4.4.2", status: "affected", version: "4.4.0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:crowd:5.0.0:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "crowd", vendor: "atlassian", versions: [ { status: "affected", version: "5.0.0", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "crucible", vendor: "atlassian", versions: [ { lessThan: "4.8.10", status: "affected", version: "0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "fisheye", vendor: "atlassian", versions: [ { lessThan: "4.8.10", status: "affected", version: "0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "jira_data_center", vendor: "atlassian", versions: [ { lessThan: "8.13.22", status: "affected", version: "8.13.0", versionType: "custom", }, { lessThan: "8.20.10", status: "affected", version: "8.14.0", versionType: "custom", }, { lessThan: "8.22.4", status: "affected", version: "8.21.0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "jira_server", vendor: "atlassian", versions: [ { lessThan: "8.13.22", status: "affected", version: "8.13.0", versionType: "custom", }, { lessThan: "8.20.10", status: "affected", version: "8.14.0", versionType: "custom", }, { lessThan: "8.22.4", status: "affected", version: "8.21.0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:jira_service_desk:-:*:*:*:server:*:*:*", ], defaultStatus: "unknown", product: "jira_service_desk", vendor: "atlassian", versions: [ { lessThan: "4.13.22", status: "affected", version: "0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:jira_service_desk:-:*:*:*:data_center:*:*:*", ], defaultStatus: "unknown", product: "jira_service_desk", vendor: "atlassian", versions: [ { lessThan: "4.13.22", status: "affected", version: "0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*", ], defaultStatus: "unknown", product: "jira_service_management", vendor: "atlassian", versions: [ { lessThan: "4.20.10", status: "affected", version: "4.14.0", versionType: "custom", }, { lessThan: "4.22.4", status: "affected", version: "4.21.0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*", ], defaultStatus: "unknown", product: "jira_service_management", vendor: "atlassian", versions: [ { lessThan: "4.20.10", status: "affected", version: "4.14.0", versionType: "custom", }, { lessThan: "4.22.4", status: "affected", version: "4.21.0", versionType: "custom", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2022-26137", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-10-03T16:48:52.174175Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-03T17:10:16.886Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "Bamboo Server", vendor: "Atlassian", versions: [ { lessThan: "8.0.9", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.1.0", versionType: "custom", }, { lessThan: "8.1.8", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.2.0", versionType: "custom", }, { lessThan: "8.2.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Bamboo Data Center", vendor: "Atlassian", versions: [ { lessThan: "8.0.9", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.1.0", versionType: "custom", }, { lessThan: "8.1.8", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.2.0", versionType: "custom", }, { lessThan: "8.2.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Bitbucket Server", vendor: "Atlassian", versions: [ { lessThan: "7.6.16", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.7.0", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.16.0", versionType: "custom", }, { lessThan: "7.17.8", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.18.0", versionType: "custom", }, { lessThan: "7.19.5", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.20.0", versionType: "custom", }, { lessThan: "7.20.2", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.21.0", versionType: "custom", }, { lessThan: "7.21.2", status: "affected", version: "unspecified", versionType: "custom", }, { status: "affected", version: "8.0.0", }, { status: "affected", version: "8.1.0", }, ], }, { product: "Bitbucket Data Center", vendor: "Atlassian", versions: [ { lessThan: "7.6.16", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.7.0", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.16.0", versionType: "custom", }, { lessThan: "7.17.8", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.18.0", versionType: "custom", }, { lessThan: "7.19.5", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.20.0", versionType: "custom", }, { lessThan: "7.20.2", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.21.0", versionType: "custom", }, { lessThan: "7.21.2", status: "affected", version: "unspecified", versionType: "custom", }, { status: "affected", version: "8.0.0", }, { status: "affected", version: "8.1.0", }, ], }, { product: "Confluence Server", vendor: "Atlassian", versions: [ { lessThan: "7.4.17", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.5.0", versionType: "custom", }, { lessThan: "7.13.7", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.14.0", versionType: "custom", }, { lessThan: "7.14.3", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.15.0", versionType: "custom", }, { lessThan: "7.15.2", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.16.0", versionType: "custom", }, { lessThan: "7.16.4", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.17.0", versionType: "custom", }, { lessThan: "7.17.4", status: "affected", version: "unspecified", versionType: "custom", }, { status: "affected", version: "7.18.0", }, ], }, { product: "Confluence Data Center", vendor: "Atlassian", versions: [ { lessThan: "7.4.17", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.5.0", versionType: "custom", }, { lessThan: "7.13.7", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.14.0", versionType: "custom", }, { lessThan: "7.14.3", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.15.0", versionType: "custom", }, { lessThan: "7.15.2", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.16.0", versionType: "custom", }, { lessThan: "7.16.4", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.17.0", versionType: "custom", }, { lessThan: "7.17.4", status: "affected", version: "unspecified", versionType: "custom", }, { status: "affected", version: "7.18.0", }, ], }, { product: "Crowd Server", vendor: "Atlassian", versions: [ { lessThan: "4.3.8", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "4.4.0", versionType: "custom", }, { lessThan: "4.4.2", status: "affected", version: "unspecified", versionType: "custom", }, { status: "affected", version: "5.0.0", }, ], }, { product: "Crowd Data Center", vendor: "Atlassian", versions: [ { lessThan: "4.3.8", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "4.4.0", versionType: "custom", }, { lessThan: "4.4.2", status: "affected", version: "unspecified", versionType: "custom", }, { status: "affected", version: "5.0.0", }, ], }, { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.10", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.10", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Jira Core Server", vendor: "Atlassian", versions: [ { lessThan: "8.13.22", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.14.0", versionType: "custom", }, { lessThan: "8.20.10", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.21.0", versionType: "custom", }, { lessThan: "8.22.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Jira Software Server", vendor: "Atlassian", versions: [ { lessThan: "8.13.22", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.14.0", versionType: "custom", }, { lessThan: "8.20.10", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.21.0", versionType: "custom", }, { lessThan: "8.22.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Jira Software Data Center", vendor: "Atlassian", versions: [ { lessThan: "8.13.22", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.14.0", versionType: "custom", }, { lessThan: "8.20.10", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.21.0", versionType: "custom", }, { lessThan: "8.22.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Jira Service Management Server", vendor: "Atlassian", versions: [ { lessThan: "4.13.22", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "4.14.0", versionType: "custom", }, { lessThan: "4.20.10", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "4.21.0", versionType: "custom", }, { lessThan: "4.22.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Jira Service Management Data Center", vendor: "Atlassian", versions: [ { lessThan: "4.13.22", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "4.14.0", versionType: "custom", }, { lessThan: "4.20.10", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "4.21.0", versionType: "custom", }, { lessThan: "4.22.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2022-07-20T00:00:00", descriptions: [ { lang: "en", value: "A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-180", description: "Incorrect Behavior Order: Validate Before Canonicalize (CWE-180)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2022-07-20T17:25:23", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/BAM-21795", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/BSERV-13370", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CONFSERVER-79476", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CWD-5815", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7410", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8541", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/JRASERVER-73897", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/JSDSERVER-11863", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2022-07-20T00:00:00", ID: "CVE-2022-26137", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Bamboo Server", version: { version_data: [ { version_affected: "<", version_value: "8.0.9", }, { version_affected: ">=", version_value: "8.1.0", }, { version_affected: "<", version_value: "8.1.8", }, { version_affected: ">=", version_value: "8.2.0", }, { version_affected: "<", version_value: "8.2.4", }, ], }, }, { product_name: "Bamboo Data Center", version: { version_data: [ { version_affected: "<", version_value: "8.0.9", }, { version_affected: ">=", version_value: "8.1.0", }, { version_affected: "<", version_value: "8.1.8", }, { version_affected: ">=", version_value: "8.2.0", }, { version_affected: "<", version_value: "8.2.4", }, ], }, }, { product_name: "Bitbucket Server", version: { version_data: [ { version_affected: "<", version_value: "7.6.16", }, { version_affected: ">=", version_value: "7.7.0", }, { version_affected: ">=", version_value: "7.16.0", }, { version_affected: "<", version_value: "7.17.8", }, { version_affected: ">=", version_value: "7.18.0", }, { version_affected: "<", version_value: "7.19.5", }, { version_affected: ">=", version_value: "7.20.0", }, { version_affected: "<", version_value: "7.20.2", }, { version_affected: ">=", version_value: "7.21.0", }, { version_affected: "<", version_value: "7.21.2", }, { version_affected: "=", version_value: "8.0.0", }, { version_affected: "=", version_value: "8.1.0", }, ], }, }, { product_name: "Bitbucket Data Center", version: { version_data: [ { version_affected: "<", version_value: "7.6.16", }, { version_affected: ">=", version_value: "7.7.0", }, { version_affected: ">=", version_value: "7.16.0", }, { version_affected: "<", version_value: "7.17.8", }, { version_affected: ">=", version_value: "7.18.0", }, { version_affected: "<", version_value: "7.19.5", }, { version_affected: ">=", version_value: "7.20.0", }, { version_affected: "<", version_value: "7.20.2", }, { version_affected: ">=", version_value: "7.21.0", }, { version_affected: "<", version_value: "7.21.2", }, { version_affected: "=", version_value: "8.0.0", }, { version_affected: "=", version_value: "8.1.0", }, ], }, }, { product_name: "Confluence Server", version: { version_data: [ { version_affected: "<", version_value: "7.4.17", }, { version_affected: ">=", version_value: "7.5.0", }, { version_affected: "<", version_value: "7.13.7", }, { version_affected: ">=", version_value: "7.14.0", }, { version_affected: "<", version_value: "7.14.3", }, { version_affected: ">=", version_value: "7.15.0", }, { version_affected: "<", version_value: "7.15.2", }, { version_affected: ">=", version_value: "7.16.0", }, { version_affected: "<", version_value: "7.16.4", }, { version_affected: ">=", version_value: "7.17.0", }, { version_affected: "<", version_value: "7.17.4", }, { version_affected: "=", version_value: "7.18.0", }, ], }, }, { product_name: "Confluence Data Center", version: { version_data: [ { version_affected: "<", version_value: "7.4.17", }, { version_affected: ">=", version_value: "7.5.0", }, { version_affected: "<", version_value: "7.13.7", }, { version_affected: ">=", version_value: "7.14.0", }, { version_affected: "<", version_value: "7.14.3", }, { version_affected: ">=", version_value: "7.15.0", }, { version_affected: "<", version_value: "7.15.2", }, { version_affected: ">=", version_value: "7.16.0", }, { version_affected: "<", version_value: "7.16.4", }, { version_affected: ">=", version_value: "7.17.0", }, { version_affected: "<", version_value: "7.17.4", }, { version_affected: "=", version_value: "7.18.0", }, ], }, }, { product_name: "Crowd Server", version: { version_data: [ { version_affected: "<", version_value: "4.3.8", }, { version_affected: ">=", version_value: "4.4.0", }, { version_affected: "<", version_value: "4.4.2", }, { version_affected: "=", version_value: "5.0.0", }, ], }, }, { product_name: "Crowd Data Center", version: { version_data: [ { version_affected: "<", version_value: "4.3.8", }, { version_affected: ">=", version_value: "4.4.0", }, { version_affected: "<", version_value: "4.4.2", }, { version_affected: "=", version_value: "5.0.0", }, ], }, }, { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.10", }, ], }, }, { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.10", }, ], }, }, { product_name: "Jira Core Server", version: { version_data: [ { version_affected: "<", version_value: "8.13.22", }, { version_affected: ">=", version_value: "8.14.0", }, { version_affected: "<", version_value: "8.20.10", }, { version_affected: ">=", version_value: "8.21.0", }, { version_affected: "<", version_value: "8.22.4", }, ], }, }, { product_name: "Jira Software Server", version: { version_data: [ { version_affected: "<", version_value: "8.13.22", }, { version_affected: ">=", version_value: "8.14.0", }, { version_affected: "<", version_value: "8.20.10", }, { version_affected: ">=", version_value: "8.21.0", }, { version_affected: "<", version_value: "8.22.4", }, ], }, }, { product_name: "Jira Software Data Center", version: { version_data: [ { version_affected: "<", version_value: "8.13.22", }, { version_affected: ">=", version_value: "8.14.0", }, { version_affected: "<", version_value: "8.20.10", }, { version_affected: ">=", version_value: "8.21.0", }, { version_affected: "<", version_value: "8.22.4", }, ], }, }, { product_name: "Jira Service Management Server", version: { version_data: [ { version_affected: "<", version_value: "4.13.22", }, { version_affected: ">=", version_value: "4.14.0", }, { version_affected: "<", version_value: "4.20.10", }, { version_affected: ">=", version_value: "4.21.0", }, { version_affected: "<", version_value: "4.22.4", }, ], }, }, { product_name: "Jira Service Management Data Center", version: { version_data: [ { version_affected: "<", version_value: "4.13.22", }, { version_affected: ">=", version_value: "4.14.0", }, { version_affected: "<", version_value: "4.20.10", }, { version_affected: ">=", version_value: "4.21.0", }, { version_affected: "<", version_value: "4.22.4", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Incorrect Behavior Order: Validate Before Canonicalize (CWE-180)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/BAM-21795", refsource: "MISC", url: "https://jira.atlassian.com/browse/BAM-21795", }, { name: "https://jira.atlassian.com/browse/BSERV-13370", refsource: "MISC", url: "https://jira.atlassian.com/browse/BSERV-13370", }, { name: "https://jira.atlassian.com/browse/CONFSERVER-79476", refsource: "MISC", url: "https://jira.atlassian.com/browse/CONFSERVER-79476", }, { name: "https://jira.atlassian.com/browse/CWD-5815", refsource: "MISC", url: "https://jira.atlassian.com/browse/CWD-5815", }, { name: "https://jira.atlassian.com/browse/FE-7410", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7410", }, { name: "https://jira.atlassian.com/browse/CRUC-8541", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8541", }, { name: "https://jira.atlassian.com/browse/JRASERVER-73897", refsource: "MISC", url: "https://jira.atlassian.com/browse/JRASERVER-73897", }, { name: "https://jira.atlassian.com/browse/JSDSERVER-11863", refsource: "MISC", url: "https://jira.atlassian.com/browse/JSDSERVER-11863", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2022-26137", datePublished: "2022-07-20T17:25:23.603830Z", dateReserved: "2022-02-25T00:00:00", dateUpdated: "2024-10-03T17:10:16.886Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2018-13392
Vulnerability from cvelistv5
Published
2018-08-13 13:00
Modified
2024-09-16 23:55
Severity ?
EPSS score ?
Summary
Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in linked issue keys.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/CRUC-8304 | x_refsource_CONFIRM | |
| https://jira.atlassian.com/browse/FE-7081 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/105096 | vdb-entry, x_refsource_BID |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Fisheye and Crucible |
Version: unspecified < 4.6.0 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T09:00:35.118Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8304", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7081", }, { name: "105096", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/105096", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye and Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.6.0", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2018-08-13T00:00:00", descriptions: [ { lang: "en", value: "Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in linked issue keys.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2018-08-17T09:57:02", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/CRUC-8304", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/FE-7081", }, { name: "105096", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/105096", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2018-08-13T00:00:00", ID: "CVE-2018-13392", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye and Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.6.0", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in linked issue keys.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/CRUC-8304", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/CRUC-8304", }, { name: "https://jira.atlassian.com/browse/FE-7081", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/FE-7081", }, { name: "105096", refsource: "BID", url: "http://www.securityfocus.com/bid/105096", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2018-13392", datePublished: "2018-08-13T13:00:00Z", dateReserved: "2018-07-06T00:00:00", dateUpdated: "2024-09-16T23:55:30.972Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2021-43957
Vulnerability from cvelistv5
Published
2022-03-16 00:55
Modified
2024-10-04 18:50
Severity ?
EPSS score ?
Summary
Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7388 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CRUC-8524 | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T04:10:17.200Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7388", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8524", }, ], title: "CVE Program Container", }, { affected: [ { cpes: [ "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "fisheye", vendor: "atlassian", versions: [ { lessThan: "4.8.9", status: "affected", version: "0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "crucible", vendor: "atlassian", versions: [ { lessThan: "4.8.9", status: "affected", version: "0", versionType: "custom", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, }, { other: { content: { id: "CVE-2021-43957", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-04T18:46:00.111042Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-639", description: "CWE-639 Authorization Bypass Through User-Controlled Key", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-10-04T18:50:25.464Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.9", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.9", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2022-03-14T00:00:00", descriptions: [ { lang: "en", value: "Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9.", }, ], problemTypes: [ { descriptions: [ { description: "Insecure Direct Object References (IDOR)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2022-03-16T00:55:18", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7388", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8524", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2022-03-14T00:00:00", ID: "CVE-2021-43957", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.9", }, ], }, }, { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.9", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Insecure Direct Object References (IDOR)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7388", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7388", }, { name: "https://jira.atlassian.com/browse/CRUC-8524", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8524", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2021-43957", datePublished: "2022-03-16T00:55:18.206995Z", dateReserved: "2021-11-16T00:00:00", dateUpdated: "2024-10-04T18:50:25.464Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2018-20239
Vulnerability from cvelistv5
Published
2019-04-30 15:28
Modified
2024-09-16 20:01
Severity ?
EPSS score ?
Summary
Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0.
References
| ▼ | URL | Tags |
|---|---|---|
| https://ecosystem.atlassian.net/browse/APL-1373 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CRUC-8379 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/FE-7161 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CONFSERVER-58208 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CWD-5362 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/JRASERVER-68855 | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Atlassian Application Links |
Version: unspecified < 5.0.11 Version: 5.1.0 < unspecified Version: unspecified < 5.2.10 Version: 5.3.0 < unspecified Version: unspecified < 5.3.6 Version: 5.4.0 < unspecified Version: unspecified < 5.4.12 Version: 6.0.0 < unspecified Version: unspecified < 6.0.4 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T11:58:18.795Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://ecosystem.atlassian.net/browse/APL-1373", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8379", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7161", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CONFSERVER-58208", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CWD-5362", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/JRASERVER-68855", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Atlassian Application Links", vendor: "Atlassian", versions: [ { lessThan: "5.0.11", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "5.1.0", versionType: "custom", }, { lessThan: "5.2.10", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "5.3.0", versionType: "custom", }, { lessThan: "5.3.6", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "5.4.0", versionType: "custom", }, { lessThan: "5.4.12", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "6.0.0", versionType: "custom", }, { lessThan: "6.0.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2019-04-29T00:00:00", descriptions: [ { lang: "en", value: "Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2019-05-29T20:20:19", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://ecosystem.atlassian.net/browse/APL-1373", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8379", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7161", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CONFSERVER-58208", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CWD-5362", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/JRASERVER-68855", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2019-04-29T00:00:00", ID: "CVE-2018-20239", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Atlassian Application Links", version: { version_data: [ { version_affected: "<", version_value: "5.0.11", }, { version_affected: ">=", version_value: "5.1.0", }, { version_affected: "<", version_value: "5.2.10", }, { version_affected: ">=", version_value: "5.3.0", }, { version_affected: "<", version_value: "5.3.6", }, { version_affected: ">=", version_value: "5.4.0", }, { version_affected: "<", version_value: "5.4.12", }, { version_affected: ">=", version_value: "6.0.0", }, { version_affected: "<", version_value: "6.0.4", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "https://ecosystem.atlassian.net/browse/APL-1373", refsource: "MISC", url: "https://ecosystem.atlassian.net/browse/APL-1373", }, { name: "https://jira.atlassian.com/browse/CRUC-8379", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8379", }, { name: "https://jira.atlassian.com/browse/FE-7161", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7161", }, { name: "https://jira.atlassian.com/browse/CONFSERVER-58208", refsource: "MISC", url: "https://jira.atlassian.com/browse/CONFSERVER-58208", }, { name: "https://jira.atlassian.com/browse/CWD-5362", refsource: "MISC", url: "https://jira.atlassian.com/browse/CWD-5362", }, { name: "https://jira.atlassian.com/browse/JRASERVER-68855", refsource: "MISC", url: "https://jira.atlassian.com/browse/JRASERVER-68855", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2018-20239", datePublished: "2019-04-30T15:28:27.775475Z", dateReserved: "2018-12-19T00:00:00", dateUpdated: "2024-09-16T20:01:43.685Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2017-14591
Vulnerability from cvelistv5
Published
2017-11-29 21:00
Modified
2024-09-16 20:46
Severity ?
EPSS score ?
Summary
Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software.
References
| ▼ | URL | Tags |
|---|---|---|
| https://confluence.atlassian.com/x/plcGO | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/102194 | vdb-entry, x_refsource_BID |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Fisheye and Crucible |
Version: Versions less than 4.4.3 OR version 4.5.0 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T19:34:38.497Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://confluence.atlassian.com/x/plcGO", }, { name: "102194", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/102194", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye and Crucible", vendor: "Atlassian", versions: [ { status: "affected", version: "Versions less than 4.4.3 OR version 4.5.0", }, ], }, ], datePublic: "2017-11-29T00:00:00", descriptions: [ { lang: "en", value: "Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software.", }, ], problemTypes: [ { descriptions: [ { description: "Arbitrary Code Execution", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2017-12-16T10:57:01", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://confluence.atlassian.com/x/plcGO", }, { name: "102194", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/102194", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2017-11-29T00:00:00", ID: "CVE-2017-14591", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye and Crucible", version: { version_data: [ { version_value: "Versions less than 4.4.3 OR version 4.5.0", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Arbitrary Code Execution", }, ], }, ], }, references: { reference_data: [ { name: "https://confluence.atlassian.com/x/plcGO", refsource: "CONFIRM", url: "https://confluence.atlassian.com/x/plcGO", }, { name: "102194", refsource: "BID", url: "http://www.securityfocus.com/bid/102194", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2017-14591", datePublished: "2017-11-29T21:00:00Z", dateReserved: "2017-09-19T00:00:00", dateUpdated: "2024-09-16T20:46:54.683Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2021-43956
Vulnerability from cvelistv5
Published
2022-03-16 00:55
Modified
2024-10-03 14:32
Severity ?
EPSS score ?
Summary
The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnerability.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7395 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CRUC-8531 | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T04:10:17.026Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7395", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8531", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2021-43956", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-03T14:32:32.446269Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-03T14:32:50.447Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.9", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.9", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2022-03-14T00:00:00", descriptions: [ { lang: "en", value: "The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnerability.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2022-03-16T00:55:16", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7395", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8531", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2022-03-14T00:00:00", ID: "CVE-2021-43956", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.9", }, ], }, }, { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.9", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnerability.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7395", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7395", }, { name: "https://jira.atlassian.com/browse/CRUC-8531", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8531", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2021-43956", datePublished: "2022-03-16T00:55:16.739962Z", dateReserved: "2021-11-16T00:00:00", dateUpdated: "2024-10-03T14:32:50.447Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2020-14190
Vulnerability from cvelistv5
Published
2020-11-25 22:40
Modified
2024-09-16 17:18
Severity ?
EPSS score ?
Summary
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/CRUC-8498 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/FE-7336 | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T12:39:36.199Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8498", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7336", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2020-11-19T00:00:00", descriptions: [ { lang: "en", value: "Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4.", }, ], problemTypes: [ { descriptions: [ { description: "Regex Denial of Service (ReDoS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-11-25T22:40:12", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8498", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7336", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2020-11-19T00:00:00", ID: "CVE-2020-14190", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.4", }, ], }, }, { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.4", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Regex Denial of Service (ReDoS)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/CRUC-8498", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8498", }, { name: "https://jira.atlassian.com/browse/FE-7336", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7336", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2020-14190", datePublished: "2020-11-25T22:40:12.690452Z", dateReserved: "2020-06-16T00:00:00", dateUpdated: "2024-09-16T17:18:22.523Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2019-15007
Vulnerability from cvelistv5
Published
2019-12-11 14:41
Modified
2024-09-16 23:30
Severity ?
EPSS score ?
Summary
The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a missing branch.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/CRUC-8439 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/FE-7250 | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T00:34:52.856Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8439", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7250", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.7.3", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.7.3", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2019-12-11T00:00:00", descriptions: [ { lang: "en", value: "The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a missing branch.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2019-12-11T14:41:13", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8439", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7250", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2019-12-11T00:00:00", ID: "CVE-2019-15007", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.7.3", }, ], }, }, { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.7.3", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a missing branch.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/CRUC-8439", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8439", }, { name: "https://jira.atlassian.com/browse/FE-7250", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7250", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2019-15007", datePublished: "2019-12-11T14:41:13.287879Z", dateReserved: "2019-08-13T00:00:00", dateUpdated: "2024-09-16T23:30:39.186Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2017-9509
Vulnerability from cvelistv5
Published
2017-08-24 17:00
Modified
2024-10-15 19:23
Severity ?
EPSS score ?
Summary
The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the charset of a previously uploaded file.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/CRUC-8046 | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Atlassian Crucible |
Version: All versions prior to version 4.4.1 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T17:11:01.570Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8046", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2017-9509", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-15T19:23:49.537700Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-15T19:23:57.414Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "Atlassian Crucible", vendor: "Atlassian", versions: [ { status: "affected", version: "All versions prior to version 4.4.1", }, ], }, ], datePublic: "2017-07-17T00:00:00", descriptions: [ { lang: "en", value: "The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the charset of a previously uploaded file.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2018-01-30T13:57:01", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8046", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2017-07-17T00:00:00", ID: "CVE-2017-9509", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Atlassian Crucible", version: { version_data: [ { version_value: "All versions prior to version 4.4.1", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the charset of a previously uploaded file.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/CRUC-8046", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8046", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2017-9509", datePublished: "2017-08-24T17:00:00Z", dateReserved: "2017-06-07T00:00:00", dateUpdated: "2024-10-15T19:23:57.414Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2018-20241
Vulnerability from cvelistv5
Published
2019-02-20 15:00
Modified
2024-09-17 00:31
Severity ?
EPSS score ?
Summary
The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the wbuser parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/107128 | vdb-entry, x_refsource_BID | |
| https://jira.atlassian.com/browse/CRUC-8380 | x_refsource_CONFIRM | |
| https://jira.atlassian.com/browse/FE-7162 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Fisheye and Crucible |
Version: unspecified < 4.7.0 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T11:58:18.849Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "107128", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/107128", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8380", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7162", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye and Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.7.0", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2019-02-15T00:00:00", descriptions: [ { lang: "en", value: "The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the wbuser parameter.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2019-02-25T10:57:01", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { name: "107128", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/107128", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/CRUC-8380", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/FE-7162", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2019-02-15T00:00:00", ID: "CVE-2018-20241", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye and Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.7.0", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the wbuser parameter.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "107128", refsource: "BID", url: "http://www.securityfocus.com/bid/107128", }, { name: "https://jira.atlassian.com/browse/CRUC-8380", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/CRUC-8380", }, { name: "https://jira.atlassian.com/browse/FE-7162", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/FE-7162", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2018-20241", datePublished: "2019-02-20T15:00:00Z", dateReserved: "2018-12-19T00:00:00", dateUpdated: "2024-09-17T00:31:10.796Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2020-4015
Vulnerability from cvelistv5
Published
2020-06-01 06:35
Modified
2024-09-16 18:09
Severity ?
EPSS score ?
Summary
The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a information disclosure vulnerability.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7284 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CRUC-8468 | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T07:52:20.704Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7284", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8468", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.1", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.1", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2020-04-21T00:00:00", descriptions: [ { lang: "en", value: "The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a information disclosure vulnerability.", }, ], problemTypes: [ { descriptions: [ { description: "Information Disclosure", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-06-01T06:35:30", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7284", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8468", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2020-04-21T00:00:00", ID: "CVE-2020-4015", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.1", }, ], }, }, { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.1", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a information disclosure vulnerability.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Information Disclosure", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7284", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7284", }, { name: "https://jira.atlassian.com/browse/CRUC-8468", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8468", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2020-4015", datePublished: "2020-06-01T06:35:31.031124Z", dateReserved: "2019-12-30T00:00:00", dateUpdated: "2024-09-16T18:09:13.525Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2018-13388
Vulnerability from cvelistv5
Published
2018-07-10 13:00
Modified
2024-09-17 01:40
Severity ?
EPSS score ?
Summary
The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in attached files.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/CRUC-8209 | x_refsource_CONFIRM | |
| https://jira.atlassian.com/browse/FE-7059 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/104717 | vdb-entry, x_refsource_BID |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Fisheye and Crucible |
Version: unspecified < 4.5.3 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T09:00:35.142Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8209", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7059", }, { name: "104717", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/104717", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye and Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.5.3", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2018-07-09T00:00:00", descriptions: [ { lang: "en", value: "The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in attached files.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2018-07-12T09:57:01", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/CRUC-8209", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/FE-7059", }, { name: "104717", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/104717", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2018-07-09T00:00:00", ID: "CVE-2018-13388", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye and Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.5.3", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in attached files.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/CRUC-8209", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/CRUC-8209", }, { name: "https://jira.atlassian.com/browse/FE-7059", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/FE-7059", }, { name: "104717", refsource: "BID", url: "http://www.securityfocus.com/bid/104717", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2018-13388", datePublished: "2018-07-10T13:00:00Z", dateReserved: "2018-07-06T00:00:00", dateUpdated: "2024-09-17T01:40:46.340Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2020-4018
Vulnerability from cvelistv5
Published
2020-06-01 06:35
Modified
2024-09-16 19:14
Severity ?
EPSS score ?
Summary
The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgery (CSRF) vulnerability.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7287 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CRUC-8471 | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T07:52:20.588Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7287", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8471", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.1", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.1", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2020-04-21T00:00:00", descriptions: [ { lang: "en", value: "The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgery (CSRF) vulnerability.", }, ], problemTypes: [ { descriptions: [ { description: "Cross-Site Request Forgery (CSRF)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-06-01T06:35:32", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7287", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8471", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2020-04-21T00:00:00", ID: "CVE-2020-4018", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.1", }, ], }, }, { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.1", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgery (CSRF) vulnerability.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross-Site Request Forgery (CSRF)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7287", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7287", }, { name: "https://jira.atlassian.com/browse/CRUC-8471", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8471", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2020-4018", datePublished: "2020-06-01T06:35:32.401398Z", dateReserved: "2019-12-30T00:00:00", dateUpdated: "2024-09-16T19:14:26.996Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2019-15009
Vulnerability from cvelistv5
Published
2019-12-11 14:41
Modified
2024-09-17 00:26
Severity ?
EPSS score ?
Summary
The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove another user's favourite setting for a project via an improper authorization vulnerability.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/CRUC-8443 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/FE-7252 | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T00:34:53.014Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8443", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7252", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.0", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.0", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2019-12-11T00:00:00", descriptions: [ { lang: "en", value: "The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove another user's favourite setting for a project via an improper authorization vulnerability.", }, ], problemTypes: [ { descriptions: [ { description: "Improper Access Control", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2019-12-11T14:41:13", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8443", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7252", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2019-12-11T00:00:00", ID: "CVE-2019-15009", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.0", }, ], }, }, { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.0", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove another user's favourite setting for a project via an improper authorization vulnerability.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Improper Access Control", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/CRUC-8443", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8443", }, { name: "https://jira.atlassian.com/browse/FE-7252", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7252", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2019-15009", datePublished: "2019-12-11T14:41:13.369901Z", dateReserved: "2019-08-13T00:00:00", dateUpdated: "2024-09-17T00:26:28.578Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2020-4017
Vulnerability from cvelistv5
Published
2020-06-01 06:35
Modified
2024-09-16 22:24
Severity ?
EPSS score ?
Summary
The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get information about any configured Jira application links via an information disclosure vulnerability.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/CRUC-8470 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/FE-7286 | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T07:52:20.678Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8470", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7286", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.1", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.1", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2020-04-21T00:00:00", descriptions: [ { lang: "en", value: "The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get information about any configured Jira application links via an information disclosure vulnerability.", }, ], problemTypes: [ { descriptions: [ { description: "Information Disclosure", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-06-01T06:35:31", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8470", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7286", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2020-04-21T00:00:00", ID: "CVE-2020-4017", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.1", }, ], }, }, { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.1", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get information about any configured Jira application links via an information disclosure vulnerability.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Information Disclosure", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/CRUC-8470", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8470", }, { name: "https://jira.atlassian.com/browse/FE-7286", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7286", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2020-4017", datePublished: "2020-06-01T06:35:31.961847Z", dateReserved: "2019-12-30T00:00:00", dateUpdated: "2024-09-16T22:24:51.577Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2020-4014
Vulnerability from cvelistv5
Published
2020-06-01 06:35
Modified
2024-09-17 03:23
Severity ?
EPSS score ?
Summary
The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's watching settings for a repository via an improper authorization vulnerability.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7283 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CRUC-8467 | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T07:52:20.578Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7283", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8467", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.1", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.1", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2020-04-21T00:00:00", descriptions: [ { lang: "en", value: "The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's watching settings for a repository via an improper authorization vulnerability.", }, ], problemTypes: [ { descriptions: [ { description: "Improper Authorization", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-06-01T06:35:30", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7283", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8467", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2020-04-21T00:00:00", ID: "CVE-2020-4014", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.1", }, ], }, }, { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.1", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's watching settings for a repository via an improper authorization vulnerability.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Improper Authorization", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7283", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7283", }, { name: "https://jira.atlassian.com/browse/CRUC-8467", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8467", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2020-4014", datePublished: "2020-06-01T06:35:30.470268Z", dateReserved: "2019-12-30T00:00:00", dateUpdated: "2024-09-17T03:23:41.066Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2020-4016
Vulnerability from cvelistv5
Published
2020-06-01 06:35
Modified
2024-09-16 16:49
Severity ?
EPSS score ?
Summary
The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get the ID of configured Jira application links via an information disclosure vulnerability.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/CRUC-8469 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/FE-7285 | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T07:52:20.545Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8469", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7285", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.1", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.1", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2020-04-21T00:00:00", descriptions: [ { lang: "en", value: "The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get the ID of configured Jira application links via an information disclosure vulnerability.", }, ], problemTypes: [ { descriptions: [ { description: "Information Disclosure", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-06-01T06:35:31", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8469", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7285", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2020-04-21T00:00:00", ID: "CVE-2020-4016", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.1", }, ], }, }, { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.1", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get the ID of configured Jira application links via an information disclosure vulnerability.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Information Disclosure", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/CRUC-8469", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8469", }, { name: "https://jira.atlassian.com/browse/FE-7285", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7285", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2020-4016", datePublished: "2020-06-01T06:35:31.473688Z", dateReserved: "2019-12-30T00:00:00", dateUpdated: "2024-09-16T16:49:09.315Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2017-18034
Vulnerability from cvelistv5
Published
2018-02-02 14:00
Modified
2024-09-16 17:38
Severity ?
EPSS score ?
Summary
The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-6994 | x_refsource_CONFIRM | |
| https://jira.atlassian.com/browse/CRUC-8161 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Fisheye and Crucible |
Version: prior to 4.5.1 and 4.6.0 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T21:06:50.156Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-6994", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8161", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye and Crucible", vendor: "Atlassian", versions: [ { status: "affected", version: "prior to 4.5.1 and 4.6.0", }, ], }, ], datePublic: "2018-01-18T00:00:00", descriptions: [ { lang: "en", value: "The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-11-25T13:56:32", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/FE-6994", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/CRUC-8161", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2018-01-18T00:00:00", ID: "CVE-2017-18034", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye and Crucible", version: { version_data: [ { version_value: "prior to 4.5.1 and 4.6.0", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-6994", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/FE-6994", }, { name: "https://jira.atlassian.com/browse/CRUC-8161", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/CRUC-8161", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2017-18034", datePublished: "2018-02-02T14:00:00Z", dateReserved: "2018-01-17T00:00:00", dateUpdated: "2024-09-16T17:38:29.337Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2019-15005
Vulnerability from cvelistv5
Published
2019-11-08 03:55
Modified
2024-09-16 20:31
Severity ?
EPSS score ?
Summary
The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira Server / Data Center before 8.3.2, Crowd / Crowd Data Center before 3.6.0, Fisheye before 4.7.2, Crucible before 4.7.2, and Bamboo before 6.10.2.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/BAM-20647 | x_refsource_MISC | |
| https://herolab.usd.de/security-advisories/usd-2019-0016/ | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Atlassian | Bitbucket Server |
Version: unspecified < 6.6.0 |
|||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T00:34:53.099Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/BAM-20647", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://herolab.usd.de/security-advisories/usd-2019-0016/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Bitbucket Server", vendor: "Atlassian", versions: [ { lessThan: "6.6.0", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Jira Server", vendor: "Atlassian", versions: [ { lessThan: "8.3.2", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Confluence Server", vendor: "Atlassian", versions: [ { lessThan: "7.0.1", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Crowd", vendor: "Atlassian", versions: [ { lessThan: "3.6.0", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.7.2", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.7.2", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Bamboo", vendor: "Atlassian", versions: [ { lessThan: "6.10.2", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2019-11-08T00:00:00", descriptions: [ { lang: "en", value: "The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira Server / Data Center before 8.3.2, Crowd / Crowd Data Center before 3.6.0, Fisheye before 4.7.2, Crucible before 4.7.2, and Bamboo before 6.10.2.", }, ], problemTypes: [ { descriptions: [ { description: "Improper Authorization", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2019-11-14T20:44:03", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/BAM-20647", }, { tags: [ "x_refsource_MISC", ], url: "https://herolab.usd.de/security-advisories/usd-2019-0016/", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2019-11-08T00:00:00", ID: "CVE-2019-15005", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Bitbucket Server", version: { version_data: [ { version_affected: "<", version_value: "6.6.0", }, ], }, }, { product_name: "Jira Server", version: { version_data: [ { version_affected: "<", version_value: "8.3.2", }, ], }, }, { product_name: "Confluence Server", version: { version_data: [ { version_affected: "<", version_value: "7.0.1", }, ], }, }, { product_name: "Crowd", version: { version_data: [ { version_affected: "<", version_value: "3.6.0", }, ], }, }, { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.7.2", }, ], }, }, { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.7.2", }, ], }, }, { product_name: "Bamboo", version: { version_data: [ { version_affected: "<", version_value: "6.10.2", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira Server / Data Center before 8.3.2, Crowd / Crowd Data Center before 3.6.0, Fisheye before 4.7.2, Crucible before 4.7.2, and Bamboo before 6.10.2.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Improper Authorization", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/BAM-20647", refsource: "MISC", url: "https://jira.atlassian.com/browse/BAM-20647", }, { name: "https://herolab.usd.de/security-advisories/usd-2019-0016/", refsource: "MISC", url: "https://herolab.usd.de/security-advisories/usd-2019-0016/", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2019-15005", datePublished: "2019-11-08T03:55:12.611106Z", dateReserved: "2019-08-13T00:00:00", dateUpdated: "2024-09-16T20:31:42.718Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2022-26136
Vulnerability from cvelistv5
Published
2022-07-20 17:25
Modified
2024-10-03 16:43
Severity ?
EPSS score ?
Summary
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/BAM-21795 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/BSERV-13370 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CONFSERVER-79476 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CWD-5815 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/FE-7410 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CRUC-8541 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/JRASERVER-73897 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/JSDSERVER-11863 | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Atlassian | Bamboo Server |
Version: unspecified < 8.0.9 Version: 8.1.0 < unspecified Version: unspecified < 8.1.8 Version: 8.2.0 < unspecified Version: unspecified < 8.2.4 |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-03T04:56:37.592Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/BAM-21795", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/BSERV-13370", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CONFSERVER-79476", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CWD-5815", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7410", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8541", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/JRASERVER-73897", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/JSDSERVER-11863", }, ], title: "CVE Program Container", }, { affected: [ { cpes: [ "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "bamboo", vendor: "atlassian", versions: [ { lessThan: "7.2.10", status: "affected", version: "7.2.0", versionType: "custom", }, { lessThan: "8.0.9", status: "affected", version: "8.0.0", versionType: "custom", }, { lessThan: "8.1.8", status: "affected", version: "8.1.0", versionType: "custom", }, { lessThan: "8.2.4", status: "affected", version: "8.2.0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "bitbucket", vendor: "atlassian", versions: [ { lessThan: "7.6.16", status: "affected", version: "0", versionType: "custom", }, { lessThan: "7.17.8", status: "affected", version: "7.7.0", versionType: "custom", }, { lessThan: "7.19.5", status: "affected", version: "7.18.0", versionType: "custom", }, { lessThan: "7.20.2", status: "affected", version: "7.20.0", versionType: "custom", }, { lessThan: "7.21.2", status: "affected", version: "7.21.0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:bitbucket:8.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:atlassian:bitbucket:8.1.0:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "bitbucket", vendor: "atlassian", versions: [ { status: "affected", version: "8.0.0", }, { status: "affected", version: "8.1.0", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "confluence_data_center", vendor: "atlassian", versions: [ { lessThan: "7.4.17", status: "affected", version: "0", versionType: "custom", }, { lessThan: "7.13.7", status: "affected", version: "7.5.0", versionType: "custom", }, { lessThan: "7.14.3", status: "affected", version: "7.14.0", versionType: "custom", }, { lessThan: "7.15.2", status: "affected", version: "7.15.0", versionType: "custom", }, { lessThan: "7.16.4", status: "affected", version: "7.16.0", versionType: "custom", }, { lessThan: "7.17.4", status: "affected", version: "7.17.0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:confluence_data_center:7.18.0:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "confluence_data_center", vendor: "atlassian", versions: [ { status: "affected", version: "7.18.0", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "confluence_server", vendor: "atlassian", versions: [ { lessThan: "7.4.17", status: "affected", version: "0", versionType: "custom", }, { lessThan: "7.13.7", status: "affected", version: "7.5.0", versionType: "custom", }, { lessThan: "7.14.3", status: "affected", version: "7.14.0", versionType: "custom", }, { lessThan: "7.15.2", status: "affected", version: "7.15.0", versionType: "custom", }, { lessThan: "7.16.4", status: "affected", version: "7.16.0", versionType: "custom", }, { lessThan: "7.17.4", status: "affected", version: "7.17.0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:confluence_server:7.18.0:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "confluence_server", vendor: "atlassian", versions: [ { status: "affected", version: "7.18.0", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "crowd", vendor: "atlassian", versions: [ { lessThan: "4.3.8", status: "affected", version: "0", versionType: "custom", }, { lessThan: "4.4.2", status: "affected", version: "4.4.0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:crowd:5.0.0:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "crowd", vendor: "atlassian", versions: [ { status: "affected", version: "5.0.0", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "crucible", vendor: "atlassian", versions: [ { lessThan: "4.8.10", status: "affected", version: "0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "fisheye", vendor: "atlassian", versions: [ { lessThan: "4.8.10", status: "affected", version: "0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "jira_data_center", vendor: "atlassian", versions: [ { lessThan: "8.13.22", status: "affected", version: "8.13.0", versionType: "custom", }, { lessThan: "8.20.10", status: "affected", version: "8.14.0", versionType: "custom", }, { lessThan: "8.22.4", status: "affected", version: "8.21.0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "jira_server", vendor: "atlassian", versions: [ { lessThan: "8.13.22", status: "affected", version: "8.13.0", versionType: "custom", }, { lessThan: "8.20.10", status: "affected", version: "8.14.0", versionType: "custom", }, { lessThan: "8.22.4", status: "affected", version: "8.21.0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:jira_service_desk:-:*:*:*:server:*:*:*", ], defaultStatus: "unknown", product: "jira_service_desk", vendor: "atlassian", versions: [ { lessThan: "4.13.22", status: "affected", version: "0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:jira_service_desk:-:*:*:*:data_center:*:*:*", ], defaultStatus: "unknown", product: "jira_service_desk", vendor: "atlassian", versions: [ { lessThan: "4.13.22", status: "affected", version: "0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*", ], defaultStatus: "unknown", product: "jira_service_management", vendor: "atlassian", versions: [ { lessThan: "4.20.10", status: "affected", version: "4.14.0", versionType: "custom", }, { lessThan: "4.22.4", status: "affected", version: "4.21.0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*", ], defaultStatus: "unknown", product: "jira_service_management", vendor: "atlassian", versions: [ { lessThan: "4.20.10", status: "affected", version: "4.14.0", versionType: "custom", }, { lessThan: "4.22.4", status: "affected", version: "4.21.0", versionType: "custom", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2022-26136", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-10-03T15:26:49.090400Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-03T16:43:16.268Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "Bamboo Server", vendor: "Atlassian", versions: [ { lessThan: "8.0.9", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.1.0", versionType: "custom", }, { lessThan: "8.1.8", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.2.0", versionType: "custom", }, { lessThan: "8.2.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Bamboo Data Center", vendor: "Atlassian", versions: [ { lessThan: "8.0.9", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.1.0", versionType: "custom", }, { lessThan: "8.1.8", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.2.0", versionType: "custom", }, { lessThan: "8.2.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Bitbucket Server", vendor: "Atlassian", versions: [ { lessThan: "7.6.16", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.7.0", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.16.0", versionType: "custom", }, { lessThan: "7.17.8", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.18.0", versionType: "custom", }, { lessThan: "7.19.5", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.20.0", versionType: "custom", }, { lessThan: "7.20.2", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.21.0", versionType: "custom", }, { lessThan: "7.21.2", status: "affected", version: "unspecified", versionType: "custom", }, { status: "affected", version: "8.0.0", }, { status: "affected", version: "8.1.0", }, ], }, { product: "Bitbucket Data Center", vendor: "Atlassian", versions: [ { lessThan: "7.6.16", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.7.0", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.16.0", versionType: "custom", }, { lessThan: "7.17.8", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.18.0", versionType: "custom", }, { lessThan: "7.19.5", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.20.0", versionType: "custom", }, { lessThan: "7.20.2", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.21.0", versionType: "custom", }, { lessThan: "7.21.2", status: "affected", version: "unspecified", versionType: "custom", }, { status: "affected", version: "8.0.0", }, { status: "affected", version: "8.1.0", }, ], }, { product: "Confluence Server", vendor: "Atlassian", versions: [ { lessThan: "7.4.17", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.5.0", versionType: "custom", }, { lessThan: "7.13.7", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.14.0", versionType: "custom", }, { lessThan: "7.14.3", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.15.0", versionType: "custom", }, { lessThan: "7.15.2", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.16.0", versionType: "custom", }, { lessThan: "7.16.4", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.17.0", versionType: "custom", }, { lessThan: "7.17.4", status: "affected", version: "unspecified", versionType: "custom", }, { status: "affected", version: "7.18.0", }, ], }, { product: "Confluence Data Center", vendor: "Atlassian", versions: [ { lessThan: "7.4.17", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.5.0", versionType: "custom", }, { lessThan: "7.13.7", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.14.0", versionType: "custom", }, { lessThan: "7.14.3", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.15.0", versionType: "custom", }, { lessThan: "7.15.2", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.16.0", versionType: "custom", }, { lessThan: "7.16.4", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "7.17.0", versionType: "custom", }, { lessThan: "7.17.4", status: "affected", version: "unspecified", versionType: "custom", }, { status: "affected", version: "7.18.0", }, ], }, { product: "Crowd Server", vendor: "Atlassian", versions: [ { lessThan: "4.3.8", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "4.4.0", versionType: "custom", }, { lessThan: "4.4.2", status: "affected", version: "unspecified", versionType: "custom", }, { status: "affected", version: "5.0.0", }, ], }, { product: "Crowd Data Center", vendor: "Atlassian", versions: [ { lessThan: "4.3.8", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "4.4.0", versionType: "custom", }, { lessThan: "4.4.2", status: "affected", version: "unspecified", versionType: "custom", }, { status: "affected", version: "5.0.0", }, ], }, { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.10", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.10", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Jira Core Server", vendor: "Atlassian", versions: [ { lessThan: "8.13.22", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.14.0", versionType: "custom", }, { lessThan: "8.20.10", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.21.0", versionType: "custom", }, { lessThan: "8.22.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Jira Software Server", vendor: "Atlassian", versions: [ { lessThan: "8.13.22", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.14.0", versionType: "custom", }, { lessThan: "8.20.10", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.21.0", versionType: "custom", }, { lessThan: "8.22.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Jira Software Data Center", vendor: "Atlassian", versions: [ { lessThan: "8.13.22", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.14.0", versionType: "custom", }, { lessThan: "8.20.10", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "8.21.0", versionType: "custom", }, { lessThan: "8.22.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Jira Service Management Server", vendor: "Atlassian", versions: [ { lessThan: "4.13.22", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "4.14.0", versionType: "custom", }, { lessThan: "4.20.10", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "4.21.0", versionType: "custom", }, { lessThan: "4.22.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Jira Service Management Data Center", vendor: "Atlassian", versions: [ { lessThan: "4.13.22", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "4.14.0", versionType: "custom", }, { lessThan: "4.20.10", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "4.21.0", versionType: "custom", }, { lessThan: "4.22.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2022-07-20T00:00:00", descriptions: [ { lang: "en", value: "A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-180", description: "Incorrect Behavior Order: Validate Before Canonicalize (CWE-180).", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2022-07-20T17:25:18", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/BAM-21795", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/BSERV-13370", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CONFSERVER-79476", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CWD-5815", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7410", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8541", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/JRASERVER-73897", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/JSDSERVER-11863", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2022-07-20T00:00:00", ID: "CVE-2022-26136", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Bamboo Server", version: { version_data: [ { version_affected: "<", version_value: "8.0.9", }, { version_affected: ">=", version_value: "8.1.0", }, { version_affected: "<", version_value: "8.1.8", }, { version_affected: ">=", version_value: "8.2.0", }, { version_affected: "<", version_value: "8.2.4", }, ], }, }, { product_name: "Bamboo Data Center", version: { version_data: [ { version_affected: "<", version_value: "8.0.9", }, { version_affected: ">=", version_value: "8.1.0", }, { version_affected: "<", version_value: "8.1.8", }, { version_affected: ">=", version_value: "8.2.0", }, { version_affected: "<", version_value: "8.2.4", }, ], }, }, { product_name: "Bitbucket Server", version: { version_data: [ { version_affected: "<", version_value: "7.6.16", }, { version_affected: ">=", version_value: "7.7.0", }, { version_affected: ">=", version_value: "7.16.0", }, { version_affected: "<", version_value: "7.17.8", }, { version_affected: ">=", version_value: "7.18.0", }, { version_affected: "<", version_value: "7.19.5", }, { version_affected: ">=", version_value: "7.20.0", }, { version_affected: "<", version_value: "7.20.2", }, { version_affected: ">=", version_value: "7.21.0", }, { version_affected: "<", version_value: "7.21.2", }, { version_affected: "=", version_value: "8.0.0", }, { version_affected: "=", version_value: "8.1.0", }, ], }, }, { product_name: "Bitbucket Data Center", version: { version_data: [ { version_affected: "<", version_value: "7.6.16", }, { version_affected: ">=", version_value: "7.7.0", }, { version_affected: ">=", version_value: "7.16.0", }, { version_affected: "<", version_value: "7.17.8", }, { version_affected: ">=", version_value: "7.18.0", }, { version_affected: "<", version_value: "7.19.5", }, { version_affected: ">=", version_value: "7.20.0", }, { version_affected: "<", version_value: "7.20.2", }, { version_affected: ">=", version_value: "7.21.0", }, { version_affected: "<", version_value: "7.21.2", }, { version_affected: "=", version_value: "8.0.0", }, { version_affected: "=", version_value: "8.1.0", }, ], }, }, { product_name: "Confluence Server", version: { version_data: [ { version_affected: "<", version_value: "7.4.17", }, { version_affected: ">=", version_value: "7.5.0", }, { version_affected: "<", version_value: "7.13.7", }, { version_affected: ">=", version_value: "7.14.0", }, { version_affected: "<", version_value: "7.14.3", }, { version_affected: ">=", version_value: "7.15.0", }, { version_affected: "<", version_value: "7.15.2", }, { version_affected: ">=", version_value: "7.16.0", }, { version_affected: "<", version_value: "7.16.4", }, { version_affected: ">=", version_value: "7.17.0", }, { version_affected: "<", version_value: "7.17.4", }, { version_affected: "=", version_value: "7.18.0", }, ], }, }, { product_name: "Confluence Data Center", version: { version_data: [ { version_affected: "<", version_value: "7.4.17", }, { version_affected: ">=", version_value: "7.5.0", }, { version_affected: "<", version_value: "7.13.7", }, { version_affected: ">=", version_value: "7.14.0", }, { version_affected: "<", version_value: "7.14.3", }, { version_affected: ">=", version_value: "7.15.0", }, { version_affected: "<", version_value: "7.15.2", }, { version_affected: ">=", version_value: "7.16.0", }, { version_affected: "<", version_value: "7.16.4", }, { version_affected: ">=", version_value: "7.17.0", }, { version_affected: "<", version_value: "7.17.4", }, { version_affected: "=", version_value: "7.18.0", }, ], }, }, { product_name: "Crowd Server", version: { version_data: [ { version_affected: "<", version_value: "4.3.8", }, { version_affected: ">=", version_value: "4.4.0", }, { version_affected: "<", version_value: "4.4.2", }, { version_affected: "=", version_value: "5.0.0", }, ], }, }, { product_name: "Crowd Data Center", version: { version_data: [ { version_affected: "<", version_value: "4.3.8", }, { version_affected: ">=", version_value: "4.4.0", }, { version_affected: "<", version_value: "4.4.2", }, { version_affected: "=", version_value: "5.0.0", }, ], }, }, { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.10", }, ], }, }, { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.10", }, ], }, }, { product_name: "Jira Core Server", version: { version_data: [ { version_affected: "<", version_value: "8.13.22", }, { version_affected: ">=", version_value: "8.14.0", }, { version_affected: "<", version_value: "8.20.10", }, { version_affected: ">=", version_value: "8.21.0", }, { version_affected: "<", version_value: "8.22.4", }, ], }, }, { product_name: "Jira Software Server", version: { version_data: [ { version_affected: "<", version_value: "8.13.22", }, { version_affected: ">=", version_value: "8.14.0", }, { version_affected: "<", version_value: "8.20.10", }, { version_affected: ">=", version_value: "8.21.0", }, { version_affected: "<", version_value: "8.22.4", }, ], }, }, { product_name: "Jira Software Data Center", version: { version_data: [ { version_affected: "<", version_value: "8.13.22", }, { version_affected: ">=", version_value: "8.14.0", }, { version_affected: "<", version_value: "8.20.10", }, { version_affected: ">=", version_value: "8.21.0", }, { version_affected: "<", version_value: "8.22.4", }, ], }, }, { product_name: "Jira Service Management Server", version: { version_data: [ { version_affected: "<", version_value: "4.13.22", }, { version_affected: ">=", version_value: "4.14.0", }, { version_affected: "<", version_value: "4.20.10", }, { version_affected: ">=", version_value: "4.21.0", }, { version_affected: "<", version_value: "4.22.4", }, ], }, }, { product_name: "Jira Service Management Data Center", version: { version_data: [ { version_affected: "<", version_value: "4.13.22", }, { version_affected: ">=", version_value: "4.14.0", }, { version_affected: "<", version_value: "4.20.10", }, { version_affected: ">=", version_value: "4.21.0", }, { version_affected: "<", version_value: "4.22.4", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Incorrect Behavior Order: Validate Before Canonicalize (CWE-180).", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/BAM-21795", refsource: "MISC", url: "https://jira.atlassian.com/browse/BAM-21795", }, { name: "https://jira.atlassian.com/browse/BSERV-13370", refsource: "MISC", url: "https://jira.atlassian.com/browse/BSERV-13370", }, { name: "https://jira.atlassian.com/browse/CONFSERVER-79476", refsource: "MISC", url: "https://jira.atlassian.com/browse/CONFSERVER-79476", }, { name: "https://jira.atlassian.com/browse/CWD-5815", refsource: "MISC", url: "https://jira.atlassian.com/browse/CWD-5815", }, { name: "https://jira.atlassian.com/browse/FE-7410", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7410", }, { name: "https://jira.atlassian.com/browse/CRUC-8541", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8541", }, { name: "https://jira.atlassian.com/browse/JRASERVER-73897", refsource: "MISC", url: "https://jira.atlassian.com/browse/JRASERVER-73897", }, { name: "https://jira.atlassian.com/browse/JSDSERVER-11863", refsource: "MISC", url: "https://jira.atlassian.com/browse/JSDSERVER-11863", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2022-26136", datePublished: "2022-07-20T17:25:18.803466Z", dateReserved: "2022-02-25T00:00:00", dateUpdated: "2024-10-03T16:43:16.268Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2018-20240
Vulnerability from cvelistv5
Published
2019-02-20 15:00
Modified
2024-09-17 00:15
Severity ?
EPSS score ?
Summary
The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7163 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/107128 | vdb-entry, x_refsource_BID | |
| https://jira.atlassian.com/browse/CRUC-8381 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Fisheye and Crucible |
Version: unspecified < 4.7.0 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T11:58:18.812Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7163", }, { name: "107128", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/107128", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8381", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye and Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.7.0", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2019-02-15T00:00:00", descriptions: [ { lang: "en", value: "The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2019-02-25T10:57:01", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/FE-7163", }, { name: "107128", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/107128", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/CRUC-8381", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2019-02-15T00:00:00", ID: "CVE-2018-20240", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye and Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.7.0", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7163", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/FE-7163", }, { name: "107128", refsource: "BID", url: "http://www.securityfocus.com/bid/107128", }, { name: "https://jira.atlassian.com/browse/CRUC-8381", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/CRUC-8381", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2018-20240", datePublished: "2019-02-20T15:00:00Z", dateReserved: "2018-12-19T00:00:00", dateUpdated: "2024-09-17T00:15:39.095Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2020-14191
Vulnerability from cvelistv5
Published
2020-11-25 21:55
Modified
2024-09-17 04:09
Severity ?
EPSS score ?
Summary
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the MessageBundleResource within Atlassian Gadgets. The affected versions are before version 4.8.4.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/CRUC-8501 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/FE-7332 | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T12:39:36.171Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8501", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7332", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2020-11-19T00:00:00", descriptions: [ { lang: "en", value: "Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the MessageBundleResource within Atlassian Gadgets. The affected versions are before version 4.8.4.", }, ], problemTypes: [ { descriptions: [ { description: "Denial of Service (DoS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-11-25T21:55:12", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8501", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7332", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2020-11-19T00:00:00", ID: "CVE-2020-14191", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.4", }, ], }, }, { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.4", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the MessageBundleResource within Atlassian Gadgets. The affected versions are before version 4.8.4.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Denial of Service (DoS)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/CRUC-8501", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8501", }, { name: "https://jira.atlassian.com/browse/FE-7332", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7332", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2020-14191", datePublished: "2020-11-25T21:55:12.551152Z", dateReserved: "2020-06-16T00:00:00", dateUpdated: "2024-09-17T04:09:47.835Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2017-18112
Vulnerability from cvelistv5
Published
2020-08-05 03:25
Modified
2024-09-16 22:15
Severity ?
EPSS score ?
Summary
Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the logging feature. The affected versions are before version 4.8.3.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7309 | x_refsource_MISC |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T21:13:48.186Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7309", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.3", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2020-08-03T00:00:00", descriptions: [ { lang: "en", value: "Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the logging feature. The affected versions are before version 4.8.3.", }, ], problemTypes: [ { descriptions: [ { description: "Information Disclosure", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-08-05T03:25:13", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7309", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2020-08-03T00:00:00", ID: "CVE-2017-18112", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.3", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the logging feature. The affected versions are before version 4.8.3.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Information Disclosure", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7309", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7309", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2017-18112", datePublished: "2020-08-05T03:25:13.445444Z", dateReserved: "2018-02-01T00:00:00", dateUpdated: "2024-09-16T22:15:39.524Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2018-5223
Vulnerability from cvelistv5
Published
2018-03-29 13:00
Modified
2024-09-16 19:56
Severity ?
EPSS score ?
Summary
Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible on the Windows operating system. All versions of Fisheye and Crucible before 4.4.6 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.3 (the fixed version for 4.5.x) are affected by this vulnerability.
References
| ▼ | URL | Tags |
|---|---|---|
| https://confluence.atlassian.com/x/aS5sO | x_refsource_CONFIRM | |
| https://jira.atlassian.com/browse/CRUC-8181 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/103665 | vdb-entry, x_refsource_BID | |
| https://confluence.atlassian.com/x/Zi5sO | x_refsource_CONFIRM | |
| https://jira.atlassian.com/browse/FE-7014 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Fisheye and Crucible |
Version: unspecified < 4.4.6 Version: 4.5.0 < unspecified Version: unspecified < 4.5.3 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T05:26:47.210Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://confluence.atlassian.com/x/aS5sO", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8181", }, { name: "103665", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/103665", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://confluence.atlassian.com/x/Zi5sO", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7014", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye and Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.4.6", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "4.5.0", versionType: "custom", }, { lessThan: "4.5.3", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2018-03-28T00:00:00", descriptions: [ { lang: "en", value: "Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible on the Windows operating system. All versions of Fisheye and Crucible before 4.4.6 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.3 (the fixed version for 4.5.x) are affected by this vulnerability.", }, ], problemTypes: [ { descriptions: [ { description: "Argument Injection", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2018-04-05T09:57:01", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://confluence.atlassian.com/x/aS5sO", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/CRUC-8181", }, { name: "103665", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/103665", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://confluence.atlassian.com/x/Zi5sO", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/FE-7014", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2018-03-28T00:00:00", ID: "CVE-2018-5223", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye and Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.4.6", }, { version_affected: ">=", version_value: "4.5.0", }, { version_affected: "<", version_value: "4.5.3", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible on the Windows operating system. All versions of Fisheye and Crucible before 4.4.6 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.3 (the fixed version for 4.5.x) are affected by this vulnerability.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Argument Injection", }, ], }, ], }, references: { reference_data: [ { name: "https://confluence.atlassian.com/x/aS5sO", refsource: "CONFIRM", url: "https://confluence.atlassian.com/x/aS5sO", }, { name: "https://jira.atlassian.com/browse/CRUC-8181", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/CRUC-8181", }, { name: "103665", refsource: "BID", url: "http://www.securityfocus.com/bid/103665", }, { name: "https://confluence.atlassian.com/x/Zi5sO", refsource: "CONFIRM", url: "https://confluence.atlassian.com/x/Zi5sO", }, { name: "https://jira.atlassian.com/browse/FE-7014", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/FE-7014", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2018-5223", datePublished: "2018-03-29T13:00:00Z", dateReserved: "2018-01-05T00:00:00", dateUpdated: "2024-09-16T19:56:55.062Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2012-2926
Vulnerability from cvelistv5
Published
2012-05-22 15:00
Modified
2024-08-06 19:50
Severity ?
EPSS score ?
Summary
Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/75682 | vdb-entry, x_refsource_XF | |
| http://secunia.com/advisories/49146 | third-party-advisory, x_refsource_SECUNIA | |
| http://confluence.atlassian.com/display/FISHEYE/FishEye+and+Crucible+Security+Advisory+2012-05-17 | x_refsource_CONFIRM | |
| http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-05-17 | x_refsource_CONFIRM | |
| http://osvdb.org/81993 | vdb-entry, x_refsource_OSVDB | |
| http://confluence.atlassian.com/display/CROWD/Crowd+Security+Advisory+2012-05-17 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/53595 | vdb-entry, x_refsource_BID | |
| http://confluence.atlassian.com/display/BAMBOO/Bamboo+Security+Advisory+2012-05-17 | x_refsource_CONFIRM | |
| http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/75697 | vdb-entry, x_refsource_XF |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-06T19:50:05.307Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "fisheye-crucible-xml-dos(75682)", tags: [ "vdb-entry", "x_refsource_XF", "x_transferred", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/75682", }, { name: "49146", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/49146", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://confluence.atlassian.com/display/FISHEYE/FishEye+and+Crucible+Security+Advisory+2012-05-17", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-05-17", }, { name: "81993", tags: [ "vdb-entry", "x_refsource_OSVDB", "x_transferred", ], url: "http://osvdb.org/81993", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://confluence.atlassian.com/display/CROWD/Crowd+Security+Advisory+2012-05-17", }, { name: "53595", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/53595", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://confluence.atlassian.com/display/BAMBOO/Bamboo+Security+Advisory+2012-05-17", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17", }, { name: "jira-xml-dos(75697)", tags: [ "vdb-entry", "x_refsource_XF", "x_transferred", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/75697", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2012-05-17T00:00:00", descriptions: [ { lang: "en", value: "Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2017-08-28T12:57:01", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { name: "fisheye-crucible-xml-dos(75682)", tags: [ "vdb-entry", "x_refsource_XF", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/75682", }, { name: "49146", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/49146", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://confluence.atlassian.com/display/FISHEYE/FishEye+and+Crucible+Security+Advisory+2012-05-17", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-05-17", }, { name: "81993", tags: [ "vdb-entry", "x_refsource_OSVDB", ], url: "http://osvdb.org/81993", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://confluence.atlassian.com/display/CROWD/Crowd+Security+Advisory+2012-05-17", }, { name: "53595", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/53595", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://confluence.atlassian.com/display/BAMBOO/Bamboo+Security+Advisory+2012-05-17", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17", }, { name: "jira-xml-dos(75697)", tags: [ "vdb-entry", "x_refsource_XF", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/75697", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2012-2926", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "fisheye-crucible-xml-dos(75682)", refsource: "XF", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/75682", }, { name: "49146", refsource: "SECUNIA", url: "http://secunia.com/advisories/49146", }, { name: "http://confluence.atlassian.com/display/FISHEYE/FishEye+and+Crucible+Security+Advisory+2012-05-17", refsource: "CONFIRM", url: "http://confluence.atlassian.com/display/FISHEYE/FishEye+and+Crucible+Security+Advisory+2012-05-17", }, { name: "http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-05-17", refsource: "CONFIRM", url: "http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-05-17", }, { name: "81993", refsource: "OSVDB", url: "http://osvdb.org/81993", }, { name: "http://confluence.atlassian.com/display/CROWD/Crowd+Security+Advisory+2012-05-17", refsource: "CONFIRM", url: "http://confluence.atlassian.com/display/CROWD/Crowd+Security+Advisory+2012-05-17", }, { name: "53595", refsource: "BID", url: "http://www.securityfocus.com/bid/53595", }, { name: "http://confluence.atlassian.com/display/BAMBOO/Bamboo+Security+Advisory+2012-05-17", refsource: "CONFIRM", url: "http://confluence.atlassian.com/display/BAMBOO/Bamboo+Security+Advisory+2012-05-17", }, { name: "http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17", refsource: "CONFIRM", url: "http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17", }, { name: "jira-xml-dos(75697)", refsource: "XF", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/75697", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2012-2926", datePublished: "2012-05-22T15:00:00", dateReserved: "2012-05-22T00:00:00", dateUpdated: "2024-08-06T19:50:05.307Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2018-5228
Vulnerability from cvelistv5
Published
2018-04-24 12:00
Modified
2024-09-17 00:51
Severity ?
EPSS score ?
Summary
The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7035 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/104006 | vdb-entry, x_refsource_BID | |
| https://jira.atlassian.com/browse/CRUC-8201 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Fisheye and Crucible |
Version: unspecified < 4.5.3 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T05:33:42.718Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7035", }, { name: "104006", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/104006", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8201", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye and Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.5.3", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2018-04-23T00:00:00", descriptions: [ { lang: "en", value: "The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2018-04-28T09:57:01", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/FE-7035", }, { name: "104006", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/104006", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/CRUC-8201", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2018-04-23T00:00:00", ID: "CVE-2018-5228", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye and Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.5.3", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7035", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/FE-7035", }, { name: "104006", refsource: "BID", url: "http://www.securityfocus.com/bid/104006", }, { name: "https://jira.atlassian.com/browse/CRUC-8201", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/CRUC-8201", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2018-5228", datePublished: "2018-04-24T12:00:00Z", dateReserved: "2018-01-05T00:00:00", dateUpdated: "2024-09-17T00:51:54.409Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2017-18093
Vulnerability from cvelistv5
Published
2018-02-19 14:00
Modified
2024-09-17 02:11
Severity ?
EPSS score ?
Summary
Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the location setting of a configured repository.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/103095 | vdb-entry, x_refsource_BID | |
| https://jira.atlassian.com/browse/CRUC-8175 | x_refsource_CONFIRM | |
| https://jira.atlassian.com/browse/FE-7008 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Fisheye and Crucible |
Version: prior to 4.4.3 Version: prior to 4.5.0 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T21:13:48.310Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "103095", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/103095", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8175", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7008", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye and Crucible", vendor: "Atlassian", versions: [ { status: "affected", version: "prior to 4.4.3", }, { status: "affected", version: "prior to 4.5.0", }, ], }, ], datePublic: "2018-02-19T00:00:00", descriptions: [ { lang: "en", value: "Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the location setting of a configured repository.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2018-02-22T10:57:01", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { name: "103095", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/103095", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/CRUC-8175", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/FE-7008", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2018-02-19T00:00:00", ID: "CVE-2017-18093", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye and Crucible", version: { version_data: [ { version_value: "prior to 4.4.3", }, { version_value: "prior to 4.5.0", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the location setting of a configured repository.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "103095", refsource: "BID", url: "http://www.securityfocus.com/bid/103095", }, { name: "https://jira.atlassian.com/browse/CRUC-8175", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/CRUC-8175", }, { name: "https://jira.atlassian.com/browse/FE-7008", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/FE-7008", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2017-18093", datePublished: "2018-02-19T14:00:00Z", dateReserved: "2018-02-01T00:00:00", dateUpdated: "2024-09-17T02:11:00.999Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2018-13399
Vulnerability from cvelistv5
Published
2018-10-16 13:00
Modified
2024-09-16 20:21
Severity ?
EPSS score ?
Summary
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7105 | x_refsource_CONFIRM | |
| https://jira.atlassian.com/browse/CRUC-8314 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Fisheye and Crucible |
Version: unspecified < 4.6.1 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T09:00:35.148Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7105", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8314", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye and Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.6.1", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2018-09-28T00:00:00", descriptions: [ { lang: "en", value: "The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.", }, ], problemTypes: [ { descriptions: [ { description: "Incorrect Permission Assignment for Critical Resource", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2018-10-16T12:57:01", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/FE-7105", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/CRUC-8314", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2018-09-28T00:00:00", ID: "CVE-2018-13399", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye and Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.6.1", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Incorrect Permission Assignment for Critical Resource", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7105", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/FE-7105", }, { name: "https://jira.atlassian.com/browse/CRUC-8314", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/CRUC-8314", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2018-13399", datePublished: "2018-10-16T13:00:00Z", dateReserved: "2018-07-06T00:00:00", dateUpdated: "2024-09-16T20:21:40.541Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2017-16859
Vulnerability from cvelistv5
Published
2018-06-28 14:00
Modified
2024-09-16 17:15
Severity ?
EPSS score ?
Summary
The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/CRUC-8212 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/104578 | vdb-entry, x_refsource_BID | |
| https://jira.atlassian.com/browse/FE-7061 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Fisheye and Crucible |
Version: unspecified < 4.3.2 Version: 4.4.0 < unspecified Version: unspecified < 4.4.3 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T20:35:21.222Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8212", }, { name: "104578", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/104578", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7061", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye and Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.3.2", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "4.4.0", versionType: "custom", }, { lessThan: "4.4.3", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2018-06-28T00:00:00", descriptions: [ { lang: "en", value: "The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parameter.", }, ], problemTypes: [ { descriptions: [ { description: "Path Traversal", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2018-06-29T09:57:01", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/CRUC-8212", }, { name: "104578", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/104578", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/FE-7061", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2018-06-28T00:00:00", ID: "CVE-2017-16859", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye and Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.3.2", }, { version_affected: ">=", version_value: "4.4.0", }, { version_affected: "<", version_value: "4.4.3", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parameter.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Path Traversal", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/CRUC-8212", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/CRUC-8212", }, { name: "104578", refsource: "BID", url: "http://www.securityfocus.com/bid/104578", }, { name: "https://jira.atlassian.com/browse/FE-7061", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/FE-7061", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2017-16859", datePublished: "2018-06-28T14:00:00Z", dateReserved: "2017-11-16T00:00:00", dateUpdated: "2024-09-16T17:15:00.298Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2020-4013
Vulnerability from cvelistv5
Published
2020-06-01 06:35
Modified
2024-09-16 20:36
Severity ?
EPSS score ?
Summary
The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the review objectives.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7282 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CRUC-8466 | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T07:52:20.435Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7282", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8466", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.1", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.1", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2020-04-21T00:00:00", descriptions: [ { lang: "en", value: "The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the review objectives.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-06-01T06:35:29", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7282", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8466", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2020-04-21T00:00:00", ID: "CVE-2020-4013", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.1", }, ], }, }, { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.1", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the review objectives.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7282", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7282", }, { name: "https://jira.atlassian.com/browse/CRUC-8466", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8466", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2020-4013", datePublished: "2020-06-01T06:35:29.971325Z", dateReserved: "2019-12-30T00:00:00", dateUpdated: "2024-09-16T20:36:58.765Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2021-43958
Vulnerability from cvelistv5
Published
2022-03-16 00:55
Modified
2024-10-04 18:55
Severity ?
EPSS score ?
Summary
Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and therefore required solving a CAPTCHA in addition to providing user credentials for authentication via a improper restriction of excess authentication attempts vulnerability.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7387 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CRUC-8523 | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T04:10:17.148Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7387", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8523", }, ], title: "CVE Program Container", }, { affected: [ { cpes: [ "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "fisheye", vendor: "atlassian", versions: [ { lessThan: "4.8.9", status: "affected", version: "0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "crucible", vendor: "atlassian", versions: [ { lessThan: "4.8.9", status: "affected", version: "0", versionType: "custom", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2021-43958", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-10-04T18:50:42.664622Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-307", description: "CWE-307 Improper Restriction of Excessive Authentication Attempts", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-10-04T18:55:11.181Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.9", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.9", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2022-03-14T00:00:00", descriptions: [ { lang: "en", value: "Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and therefore required solving a CAPTCHA in addition to providing user credentials for authentication via a improper restriction of excess authentication attempts vulnerability.", }, ], problemTypes: [ { descriptions: [ { description: "Improper Restriction of Excessive Authentication Attempts", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2022-03-16T00:55:19", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7387", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8523", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2022-03-14T00:00:00", ID: "CVE-2021-43958", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.9", }, ], }, }, { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.9", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and therefore required solving a CAPTCHA in addition to providing user credentials for authentication via a improper restriction of excess authentication attempts vulnerability.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Improper Restriction of Excessive Authentication Attempts", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7387", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7387", }, { name: "https://jira.atlassian.com/browse/CRUC-8523", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8523", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2021-43958", datePublished: "2022-03-16T00:55:19.574907Z", dateReserved: "2021-11-16T00:00:00", dateUpdated: "2024-10-04T18:55:11.181Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2017-16861
Vulnerability from cvelistv5
Published
2018-02-01 04:00
Modified
2024-09-16 22:56
Severity ?
EPSS score ?
Summary
It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fisheye or Crucible or who hosts a website that a user who can access the web interface of Fisheye or Crucible visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Fisheye or Crucible. All versions of Fisheye and Crucible before 4.4.5 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.2 (the fixed version for 4.5.x) are affected by this vulnerability.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/CRUC-8156 | x_refsource_MISC | |
| https://confluence.atlassian.com/x/h-QyO | x_refsource_MISC | |
| http://www.securityfocus.com/bid/102971 | vdb-entry, x_refsource_BID | |
| https://confluence.atlassian.com/x/iPQyO | x_refsource_MISC | |
| https://jira.atlassian.com/browse/FE-6991 | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Fisheye and Crucible |
Version: prior to 4.4.5 Version: 4.5.0 prior to 4.5.2 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T20:35:21.220Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8156", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://confluence.atlassian.com/x/h-QyO", }, { name: "102971", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/102971", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://confluence.atlassian.com/x/iPQyO", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-6991", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye and Crucible", vendor: "Atlassian", versions: [ { status: "affected", version: "prior to 4.4.5", }, { status: "affected", version: "4.5.0 prior to 4.5.2", }, ], }, ], datePublic: "2018-01-31T00:00:00", descriptions: [ { lang: "en", value: "It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fisheye or Crucible or who hosts a website that a user who can access the web interface of Fisheye or Crucible visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Fisheye or Crucible. All versions of Fisheye and Crucible before 4.4.5 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.2 (the fixed version for 4.5.x) are affected by this vulnerability.", }, ], problemTypes: [ { descriptions: [ { description: "Remote Code Execution", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2018-02-10T10:57:01", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8156", }, { tags: [ "x_refsource_MISC", ], url: "https://confluence.atlassian.com/x/h-QyO", }, { name: "102971", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/102971", }, { tags: [ "x_refsource_MISC", ], url: "https://confluence.atlassian.com/x/iPQyO", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-6991", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2018-01-31T00:00:00", ID: "CVE-2017-16861", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye and Crucible", version: { version_data: [ { version_value: "prior to 4.4.5", }, { version_value: "4.5.0 prior to 4.5.2", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fisheye or Crucible or who hosts a website that a user who can access the web interface of Fisheye or Crucible visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Fisheye or Crucible. All versions of Fisheye and Crucible before 4.4.5 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.2 (the fixed version for 4.5.x) are affected by this vulnerability.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Remote Code Execution", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/CRUC-8156", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8156", }, { name: "https://confluence.atlassian.com/x/h-QyO", refsource: "MISC", url: "https://confluence.atlassian.com/x/h-QyO", }, { name: "102971", refsource: "BID", url: "http://www.securityfocus.com/bid/102971", }, { name: "https://confluence.atlassian.com/x/iPQyO", refsource: "MISC", url: "https://confluence.atlassian.com/x/iPQyO", }, { name: "https://jira.atlassian.com/browse/FE-6991", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-6991", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2017-16861", datePublished: "2018-02-01T04:00:00Z", dateReserved: "2017-11-16T00:00:00", dateUpdated: "2024-09-16T22:56:24.722Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2017-9507
Vulnerability from cvelistv5
Published
2017-08-24 17:00
Modified
2024-10-15 19:20
Severity ?
EPSS score ?
Summary
The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the review filter title parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/CRUC-8043 | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Atlassian Crucible |
Version: From version 4.1.0 before version 4.4.1. |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T17:11:01.699Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8043", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2017-9507", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-15T19:20:33.456278Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-15T19:20:41.669Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "Atlassian Crucible", vendor: "Atlassian", versions: [ { status: "affected", version: "From version 4.1.0 before version 4.4.1.", }, ], }, ], datePublic: "2017-07-17T00:00:00", descriptions: [ { lang: "en", value: "The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the review filter title parameter.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2018-01-30T13:57:01", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8043", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2017-07-17T00:00:00", ID: "CVE-2017-9507", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Atlassian Crucible", version: { version_data: [ { version_value: "From version 4.1.0 before version 4.4.1.", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the review filter title parameter.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/CRUC-8043", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8043", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2017-9507", datePublished: "2017-08-24T17:00:00Z", dateReserved: "2017-06-07T00:00:00", dateUpdated: "2024-10-15T19:20:41.669Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2017-9508
Vulnerability from cvelistv5
Published
2017-08-24 17:00
Modified
2024-10-15 19:23
Severity ?
EPSS score ?
Summary
Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a repository or review file.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/CRUC-8044 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/FE-6898 | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Atlassian Fisheye and Crucible |
Version: All versions prior to version 4.4.1 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T17:11:01.612Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8044", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-6898", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2017-9508", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-15T19:23:11.170253Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-15T19:23:22.364Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "Atlassian Fisheye and Crucible", vendor: "Atlassian", versions: [ { status: "affected", version: "All versions prior to version 4.4.1", }, ], }, ], datePublic: "2017-07-17T00:00:00", descriptions: [ { lang: "en", value: "Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a repository or review file.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-11-25T13:56:32", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8044", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-6898", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2017-07-17T00:00:00", ID: "CVE-2017-9508", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Atlassian Fisheye and Crucible", version: { version_data: [ { version_value: "All versions prior to version 4.4.1", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a repository or review file.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/CRUC-8044", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8044", }, { name: "https://jira.atlassian.com/browse/FE-6898", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-6898", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2017-9508", datePublished: "2017-08-24T17:00:00Z", dateReserved: "2017-06-07T00:00:00", dateUpdated: "2024-10-15T19:23:22.364Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2017-18090
Vulnerability from cvelistv5
Published
2018-02-16 18:00
Modified
2024-09-17 01:40
Severity ?
EPSS score ?
Summary
Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a commit author.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7000 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/103076 | vdb-entry, x_refsource_BID |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T21:13:47.493Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7000", }, { name: "103076", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/103076", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye", vendor: "Atlassian", versions: [ { status: "affected", version: "prior to 4.5.1", }, { status: "affected", version: "prior to 4.6.0", }, ], }, ], datePublic: "2018-02-16T00:00:00", descriptions: [ { lang: "en", value: "Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a commit author.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2018-02-21T10:57:01", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/FE-7000", }, { name: "103076", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/103076", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2018-02-16T00:00:00", ID: "CVE-2017-18090", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye", version: { version_data: [ { version_value: "prior to 4.5.1", }, { version_value: "prior to 4.6.0", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a commit author.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7000", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/FE-7000", }, { name: "103076", refsource: "BID", url: "http://www.securityfocus.com/bid/103076", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2017-18090", datePublished: "2018-02-16T18:00:00Z", dateReserved: "2018-02-01T00:00:00", dateUpdated: "2024-09-17T01:40:40.678Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2020-4026
Vulnerability from cvelistv5
Published
2020-06-02 23:40
Modified
2024-09-17 04:05
Severity ?
EPSS score ?
Summary
The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from version 5.0.0 before 5.0.1, and from version 5.1.0 before 5.1.1 allows remote attackers to enumerate all linked applications, including those that are restricted or otherwise hidden, through an incorrect authorization check.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7299 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CRUC-8485 | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Atlassian | Navigator Links |
Version: unspecified < 3.2.23 Version: 4.0.0 < unspecified Version: unspecified < 4.3.7 Version: 5.0.0 < unspecified Version: unspecified < 5.0.1 Version: 5.1.0 < unspecified Version: unspecified < 5.1.1 |
|||||||||||
|
||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T07:52:20.704Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7299", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8485", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Navigator Links", vendor: "Atlassian", versions: [ { lessThan: "3.2.23", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "4.0.0", versionType: "custom", }, { lessThan: "4.3.7", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "5.0.0", versionType: "custom", }, { lessThan: "5.0.1", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "affected", version: "5.1.0", versionType: "custom", }, { lessThan: "5.1.1", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.2", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.2", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2020-06-01T00:00:00", descriptions: [ { lang: "en", value: "The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from version 5.0.0 before 5.0.1, and from version 5.1.0 before 5.1.1 allows remote attackers to enumerate all linked applications, including those that are restricted or otherwise hidden, through an incorrect authorization check.", }, ], problemTypes: [ { descriptions: [ { description: "Incorrect Authorization", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-06-02T23:40:12", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7299", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8485", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2020-06-01T00:00:00", ID: "CVE-2020-4026", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Navigator Links", version: { version_data: [ { version_affected: "<", version_value: "3.2.23", }, { version_affected: ">=", version_value: "4.0.0", }, { version_affected: "<", version_value: "4.3.7", }, { version_affected: ">=", version_value: "5.0.0", }, { version_affected: "<", version_value: "5.0.1", }, { version_affected: ">=", version_value: "5.1.0", }, { version_affected: "<", version_value: "5.1.1", }, ], }, }, { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.2", }, ], }, }, { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.2", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from version 5.0.0 before 5.0.1, and from version 5.1.0 before 5.1.1 allows remote attackers to enumerate all linked applications, including those that are restricted or otherwise hidden, through an incorrect authorization check.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Incorrect Authorization", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7299", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7299", }, { name: "https://jira.atlassian.com/browse/CRUC-8485", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8485", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2020-4026", datePublished: "2020-06-02T23:40:12.121427Z", dateReserved: "2019-12-30T00:00:00", dateUpdated: "2024-09-17T04:05:05.012Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2018-13398
Vulnerability from cvelistv5
Published
2018-09-18 14:00
Modified
2024-09-16 18:34
Severity ?
EPSS score ?
Summary
The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery (CSRF) vulnerability.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7100 | x_refsource_CONFIRM | |
| https://jira.atlassian.com/browse/CRUC-8312 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Fisheye and Crucible |
Version: unspecified < 4.5.4 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T09:00:35.196Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7100", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8312", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye and Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.5.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2018-09-17T00:00:00", descriptions: [ { lang: "en", value: "The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery (CSRF) vulnerability.", }, ], problemTypes: [ { descriptions: [ { description: "Cross-Site Request Forgery (CSRF)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2018-09-18T13:57:02", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/FE-7100", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/CRUC-8312", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2018-09-17T00:00:00", ID: "CVE-2018-13398", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye and Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.5.4", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery (CSRF) vulnerability.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross-Site Request Forgery (CSRF)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7100", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/FE-7100", }, { name: "https://jira.atlassian.com/browse/CRUC-8312", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/CRUC-8312", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2018-13398", datePublished: "2018-09-18T14:00:00Z", dateReserved: "2018-07-06T00:00:00", dateUpdated: "2024-09-16T18:34:54.617Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2020-14192
Vulnerability from cvelistv5
Published
2021-02-01 23:45
Modified
2024-09-16 16:14
Severity ?
EPSS score ?
Summary
Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen response header from Atlassian Analytics. The affected versions are before version 4.8.4.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7334 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CRUC-8502 | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T12:39:36.127Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7334", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8502", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.4", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2020-11-11T00:00:00", descriptions: [ { lang: "en", value: "Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen response header from Atlassian Analytics. The affected versions are before version 4.8.4.", }, ], problemTypes: [ { descriptions: [ { description: "Information Disclosure", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2021-02-01T23:45:15", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7334", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8502", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2020-11-11T00:00:00", ID: "CVE-2020-14192", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.4", }, ], }, }, { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.4", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen response header from Atlassian Analytics. The affected versions are before version 4.8.4.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Information Disclosure", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7334", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7334", }, { name: "https://jira.atlassian.com/browse/CRUC-8502", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8502", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2020-14192", datePublished: "2021-02-01T23:45:15.351944Z", dateReserved: "2020-06-16T00:00:00", dateUpdated: "2024-09-16T16:14:04.913Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2021-43954
Vulnerability from cvelistv5
Published
2022-03-14 01:45
Modified
2024-10-04 18:45
Severity ?
EPSS score ?
Summary
The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7384 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CRUC-8520 | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T04:10:17.160Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7384", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8520", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2021-43954", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-04T18:45:34.909968Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-04T18:45:42.732Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.9", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.9", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2022-03-07T00:00:00", descriptions: [ { lang: "en", value: "The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.", }, ], problemTypes: [ { descriptions: [ { description: "Server Side Request Forgery (SSRF)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2022-03-14T01:45:17", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7384", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8520", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2022-03-07T00:00:00", ID: "CVE-2021-43954", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.9", }, ], }, }, { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.9", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Server Side Request Forgery (SSRF)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7384", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7384", }, { name: "https://jira.atlassian.com/browse/CRUC-8520", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8520", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2021-43954", datePublished: "2022-03-14T01:45:18.016064Z", dateReserved: "2021-11-16T00:00:00", dateUpdated: "2024-10-04T18:45:42.732Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2017-14588
Vulnerability from cvelistv5
Published
2017-10-11 18:00
Modified
2024-10-15 19:14
Severity ?
EPSS score ?
Summary
Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the dialog parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/101268 | vdb-entry, x_refsource_BID | |
| https://jira.atlassian.com/browse/FE-6935 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CRUC-8113 | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Atlassian Fisheye and Crucible |
Version: All versions prior to version 4.4.2 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T19:34:39.861Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "101268", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/101268", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-6935", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8113", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2017-14588", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-15T19:14:27.079452Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-15T19:14:38.109Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "Atlassian Fisheye and Crucible", vendor: "Atlassian", versions: [ { status: "affected", version: "All versions prior to version 4.4.2", }, ], }, ], datePublic: "2017-10-10T00:00:00", descriptions: [ { lang: "en", value: "Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the dialog parameter.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-11-25T13:56:32", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { name: "101268", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/101268", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-6935", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8113", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2017-10-10T00:00:00", ID: "CVE-2017-14588", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Atlassian Fisheye and Crucible", version: { version_data: [ { version_value: "All versions prior to version 4.4.2", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the dialog parameter.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "101268", refsource: "BID", url: "http://www.securityfocus.com/bid/101268", }, { name: "https://jira.atlassian.com/browse/FE-6935", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-6935", }, { name: "https://jira.atlassian.com/browse/CRUC-8113", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8113", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2017-14588", datePublished: "2017-10-11T18:00:00Z", dateReserved: "2017-09-19T00:00:00", dateUpdated: "2024-10-15T19:14:38.109Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2019-15008
Vulnerability from cvelistv5
Published
2019-12-11 14:41
Modified
2024-09-16 23:21
Severity ?
EPSS score ?
Summary
The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the reviewedBranch parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/CRUC-8441 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/FE-7251 | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T00:34:53.154Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8441", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7251", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.7.3", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.7.3", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2019-12-11T00:00:00", descriptions: [ { lang: "en", value: "The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the reviewedBranch parameter.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2019-12-11T14:41:13", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8441", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7251", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2019-12-11T00:00:00", ID: "CVE-2019-15008", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.7.3", }, ], }, }, { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.7.3", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the reviewedBranch parameter.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/CRUC-8441", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8441", }, { name: "https://jira.atlassian.com/browse/FE-7251", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7251", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2019-15008", datePublished: "2019-12-11T14:41:13.338614Z", dateReserved: "2019-08-13T00:00:00", dateUpdated: "2024-09-16T23:21:09.755Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2017-9512
Vulnerability from cvelistv5
Published
2017-08-24 17:00
Modified
2024-10-16 14:05
Severity ?
EPSS score ?
Summary
The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/CRUC-8053 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/FE-6892 | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Atlassian Fisheye and Crucible |
Version: All versions prior to version 4.4.1 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T17:11:01.591Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8053", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-6892", }, ], title: "CVE Program Container", }, { affected: [ { cpes: [ "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "fisheye", vendor: "atlassian", versions: [ { lessThan: "4.4.1", status: "affected", version: "0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "crucible", vendor: "atlassian", versions: [ { lessThan: "4.4.1", status: "affected", version: "0", versionType: "custom", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, }, { other: { content: { id: "CVE-2017-9512", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-16T14:03:50.713684Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-16T14:05:19.181Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "Atlassian Fisheye and Crucible", vendor: "Atlassian", versions: [ { status: "affected", version: "All versions prior to version 4.4.1", }, ], }, ], datePublic: "2017-07-17T00:00:00", descriptions: [ { lang: "en", value: "The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks.", }, ], problemTypes: [ { descriptions: [ { description: "Improper Access Control", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-11-25T13:56:32", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8053", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-6892", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2017-07-17T00:00:00", ID: "CVE-2017-9512", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Atlassian Fisheye and Crucible", version: { version_data: [ { version_value: "All versions prior to version 4.4.1", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Improper Access Control", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/CRUC-8053", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8053", }, { name: "https://jira.atlassian.com/browse/FE-6892", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-6892", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2017-9512", datePublished: "2017-08-24T17:00:00Z", dateReserved: "2017-06-07T00:00:00", dateUpdated: "2024-10-16T14:05:19.181Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2011-4822
Vulnerability from cvelistv5
Published
2011-12-15 02:00
Modified
2024-08-07 00:16
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the user profile feature in Atlassian FishEye before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) snippets in a user comment, which is not properly handled in a Confluence page, or (2) the user profile display name, which is not properly handled in a FishEye page.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/71426 | vdb-entry, x_refsource_XF | |
| https://jira.atlassian.com/browse/FE-3797 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/71427 | vdb-entry, x_refsource_XF | |
| https://jira.atlassian.com/browse/FE-3798 | x_refsource_CONFIRM | |
| http://osvdb.org/77264 | vdb-entry, x_refsource_OSVDB | |
| http://confluence.atlassian.com/display/FISHEYE/FishEye+and+Crucible+Security+Advisory+2011-11-22 | x_refsource_CONFIRM | |
| http://secunia.com/advisories/46975 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/50762 | vdb-entry, x_refsource_BID | |
| http://osvdb.org/77263 | vdb-entry, x_refsource_OSVDB |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-07T00:16:34.940Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "fisheye-display-name-xss(71426)", tags: [ "vdb-entry", "x_refsource_XF", "x_transferred", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/71426", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-3797", }, { name: "fisheye-comment-xss(71427)", tags: [ "vdb-entry", "x_refsource_XF", "x_transferred", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/71427", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-3798", }, { name: "77264", tags: [ "vdb-entry", "x_refsource_OSVDB", "x_transferred", ], url: "http://osvdb.org/77264", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://confluence.atlassian.com/display/FISHEYE/FishEye+and+Crucible+Security+Advisory+2011-11-22", }, { name: "46975", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/46975", }, { name: "50762", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/50762", }, { name: "77263", tags: [ "vdb-entry", "x_refsource_OSVDB", "x_transferred", ], url: "http://osvdb.org/77263", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2011-10-24T00:00:00", descriptions: [ { lang: "en", value: "Multiple cross-site scripting (XSS) vulnerabilities in the user profile feature in Atlassian FishEye before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) snippets in a user comment, which is not properly handled in a Confluence page, or (2) the user profile display name, which is not properly handled in a FishEye page.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2017-08-28T12:57:01", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { name: "fisheye-display-name-xss(71426)", tags: [ "vdb-entry", "x_refsource_XF", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/71426", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/FE-3797", }, { name: "fisheye-comment-xss(71427)", tags: [ "vdb-entry", "x_refsource_XF", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/71427", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://jira.atlassian.com/browse/FE-3798", }, { name: "77264", tags: [ "vdb-entry", "x_refsource_OSVDB", ], url: "http://osvdb.org/77264", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://confluence.atlassian.com/display/FISHEYE/FishEye+and+Crucible+Security+Advisory+2011-11-22", }, { name: "46975", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/46975", }, { name: "50762", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/50762", }, { name: "77263", tags: [ "vdb-entry", "x_refsource_OSVDB", ], url: "http://osvdb.org/77263", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2011-4822", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Multiple cross-site scripting (XSS) vulnerabilities in the user profile feature in Atlassian FishEye before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) snippets in a user comment, which is not properly handled in a Confluence page, or (2) the user profile display name, which is not properly handled in a FishEye page.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "fisheye-display-name-xss(71426)", refsource: "XF", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/71426", }, { name: "https://jira.atlassian.com/browse/FE-3797", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/FE-3797", }, { name: "fisheye-comment-xss(71427)", refsource: "XF", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/71427", }, { name: "https://jira.atlassian.com/browse/FE-3798", refsource: "CONFIRM", url: "https://jira.atlassian.com/browse/FE-3798", }, { name: "77264", refsource: "OSVDB", url: "http://osvdb.org/77264", }, { name: "http://confluence.atlassian.com/display/FISHEYE/FishEye+and+Crucible+Security+Advisory+2011-11-22", refsource: "CONFIRM", url: "http://confluence.atlassian.com/display/FISHEYE/FishEye+and+Crucible+Security+Advisory+2011-11-22", }, { name: "46975", refsource: "SECUNIA", url: "http://secunia.com/advisories/46975", }, { name: "50762", refsource: "BID", url: "http://www.securityfocus.com/bid/50762", }, { name: "77263", refsource: "OSVDB", url: "http://osvdb.org/77263", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2011-4822", datePublished: "2011-12-15T02:00:00", dateReserved: "2011-12-14T00:00:00", dateUpdated: "2024-08-07T00:16:34.940Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2020-29446
Vulnerability from cvelistv5
Published
2021-01-18 01:30
Modified
2024-09-17 02:21
Severity ?
EPSS score ?
Summary
Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory. The affected versions are before version 4.8.5.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/CRUC-8496 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/FE-7326 | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T16:55:10.407Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8496", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7326", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.5", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.5", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2020-12-10T00:00:00", descriptions: [ { lang: "en", value: "Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory. The affected versions are before version 4.8.5.", }, ], problemTypes: [ { descriptions: [ { description: "Insecure Direct Object References (IDOR)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2021-01-18T01:30:16", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8496", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7326", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2020-12-10T00:00:00", ID: "CVE-2020-29446", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.5", }, ], }, }, { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.5", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory. The affected versions are before version 4.8.5.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Insecure Direct Object References (IDOR)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/CRUC-8496", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8496", }, { name: "https://jira.atlassian.com/browse/FE-7326", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7326", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2020-29446", datePublished: "2021-01-18T01:30:16.421702Z", dateReserved: "2020-12-01T00:00:00", dateUpdated: "2024-09-17T02:21:39.035Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2017-9510
Vulnerability from cvelistv5
Published
2017-08-24 17:00
Modified
2024-10-16 14:03
Severity ?
EPSS score ?
Summary
The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the start date and end date parameters.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-6890 | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Atlassian | Atlassian Fisheye |
Version: All versions prior to version 4.4.1 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T17:11:01.626Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-6890", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2017-9510", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-16T14:03:25.262716Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-16T14:03:34.200Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "Atlassian Fisheye", vendor: "Atlassian", versions: [ { status: "affected", version: "All versions prior to version 4.4.1", }, ], }, ], datePublic: "2017-07-17T00:00:00", descriptions: [ { lang: "en", value: "The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the start date and end date parameters.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-11-25T13:56:32", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-6890", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2017-07-17T00:00:00", ID: "CVE-2017-9510", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Atlassian Fisheye", version: { version_data: [ { version_value: "All versions prior to version 4.4.1", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the start date and end date parameters.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-6890", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-6890", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2017-9510", datePublished: "2017-08-24T17:00:00Z", dateReserved: "2017-06-07T00:00:00", dateUpdated: "2024-10-16T14:03:34.200Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2020-4023
Vulnerability from cvelistv5
Published
2020-06-01 06:35
Modified
2024-09-17 03:42
Severity ?
EPSS score ?
Summary
The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the committerFilter parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://jira.atlassian.com/browse/FE-7298 | x_refsource_MISC | |
| https://jira.atlassian.com/browse/CRUC-8482 | x_refsource_MISC |
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T07:52:20.579Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/FE-7298", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://jira.atlassian.com/browse/CRUC-8482", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Crucible", vendor: "Atlassian", versions: [ { lessThan: "4.8.2", status: "affected", version: "unspecified", versionType: "custom", }, ], }, { product: "Fisheye", vendor: "Atlassian", versions: [ { lessThan: "4.8.2", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], datePublic: "2020-05-29T00:00:00", descriptions: [ { lang: "en", value: "The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the committerFilter parameter.", }, ], problemTypes: [ { descriptions: [ { description: "Cross Site Scripting (XSS)", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-06-01T06:35:34", orgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", shortName: "atlassian", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/FE-7298", }, { tags: [ "x_refsource_MISC", ], url: "https://jira.atlassian.com/browse/CRUC-8482", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@atlassian.com", DATE_PUBLIC: "2020-05-29T00:00:00", ID: "CVE-2020-4023", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Crucible", version: { version_data: [ { version_affected: "<", version_value: "4.8.2", }, ], }, }, { product_name: "Fisheye", version: { version_data: [ { version_affected: "<", version_value: "4.8.2", }, ], }, }, ], }, vendor_name: "Atlassian", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the committerFilter parameter.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Cross Site Scripting (XSS)", }, ], }, ], }, references: { reference_data: [ { name: "https://jira.atlassian.com/browse/FE-7298", refsource: "MISC", url: "https://jira.atlassian.com/browse/FE-7298", }, { name: "https://jira.atlassian.com/browse/CRUC-8482", refsource: "MISC", url: "https://jira.atlassian.com/browse/CRUC-8482", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", assignerShortName: "atlassian", cveId: "CVE-2020-4023", datePublished: "2020-06-01T06:35:34.336809Z", dateReserved: "2019-12-30T00:00:00", dateUpdated: "2024-09-17T03:42:59.732Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
var-201008-0298
Vulnerability from variot
The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504. Used for multiple products Apache Struts of XWork In OGNL For the expression evaluation of "#" ParameterInterceptors A vulnerability exists that bypasses the protection mechanism. XWork is prone to a security-bypass vulnerability because it fails to adequately handle user-supplied input. Attackers can exploit this issue to manipulate server-side context objects with the privileges of the user running the application. Successful exploits can compromise the application and possibly the underlying computer. This issue is related to the vulnerability documented in BID 32101 (XWork 'ParameterInterceptor' Class OGNL Security Bypass Vulnerability); the implemented solution appears to have been incomplete. The component uses the ParameterInterceptors directive to parse the Object-Graph Navigation Language (OGNL) expressions that are implemented via a whitelist feature. An attacker could exploit this vulnerability by sending crafted requests that contain OGNL expressions to an affected system. An exploit could allow the attacker to execute arbitrary code on the targeted system.
Cisco has released free software updates that address this vulnerability for all the affected products except Cisco Business Edition 3000 Series. Customers using Cisco Business Edition 3000 Series should contact their Cisco representative for available options.
Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available. ----------------------------------------------------------------------
Passionate about writing secure code?
http://secunia.com/company/jobs/open_positions/talented_programmer
Read this if your favourite tool is a disassembler
http://secunia.com/company/jobs/open_positions/reverse_engineer
TITLE: XWork "ParameterInterceptor" Security Bypass Vulnerability
SECUNIA ADVISORY ID: SA40558
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/40558/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=40558
RELEASE DATE: 2010-07-13
DISCUSS ADVISORY: http://secunia.com/advisories/40558/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/40558/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=40558
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: A vulnerability has been reported in XWork, which can be exploited by malicious people to bypass certain security restrictions.
The vulnerability is caused due to the "ParameterInterceptor" class improperly restricting access to server-side objects. This can be exploited to modify server-side objects and e.g.
This is related to: SA32495
SOLUTION: Filter malicious characters and character sequences using a proxy.
PROVIDED AND/OR DISCOVERED BY: Meder Kydyraliev, Google Security Team
ORIGINAL ADVISORY: http://blog.o0o.nu/2010/07/cve-2010-1870-struts2xwork-remote.html
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
VMware Security Advisory
Advisory ID: VMSA-2011-0005 Synopsis: VMware vCenter Orchestrator remote code execution vulnerability Issue date: 2011-03-14 Updated on: 2011-03-14 (initial release of advisory) CVE numbers: CVE-2010-1870
- Summary
A vulnerability in VMware vCenter Orchestrator(vCO) could allow remote execution.
- Relevant releases
VMware vCenter Orchestrator 4.1 VMware vCenter Orchestrator 4.0
-
Problem Description
VMware vCenter Orchestrator is an application to automate management tasks. It embeds Apache Struts (version 2.0.11) which is a third party component.
The following vulnerability has been reported in Apache Struts 2.0.11 or earlier. A remote execution of code vulnerability could allow malicious users to bypass the '#'-usage protection built into the ParametersInterceptor, which could allow server side context objects to be manipulated.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-1870 to this vulnerability.
VMware would like to thank the Vulnerability Research Team of Digital Defense, Inc. for reporting this issue to us.
Apache Struts version 2.0.11 and earlier also contain vulnerabilities which have not been assigned CVE names. This advisory also addresses these vulnerabilities described at the following URLs:
- http://struts.apache.org/2.2.1/docs/s2-002.html
- http://struts.apache.org/2.2.1/docs/s2-003.html
- http://struts.apache.org/2.2.1/docs/s2-004.html
Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.
VMware Product Running Replace with/ Product Version on Apply Patch ============= ======== ======= ================= vCO 4.1 Windows vCO fix for Apache Struts * vCO 4.0 Windows vCO fix for Apache Struts *
- Refer to VMware Knowledge Base article 1034175 for a workaround.
-
Solution
Vmware vCenter Orchestrator
vCenter Orchestrator workaround for Apache Struts http://kb.vmware.com/kb/1034175
-
References
CVE numbers http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1870
- Change log
2011-03-14 VMSA-2011-0005 Initial security advisory in conjunction with the release of an Apache Struts workaround for VMware vCenter Orchestrator on 2011-03-14.
- Contact
E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
- security-announce at lists.vmware.com
- bugtraq at securityfocus.com
- full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories http://www.vmware.com/security/advisories
VMware security response policy http://www.vmware.com/support/policies/security_response.html
General support life cycle policy http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy http://www.vmware.com/support/policies/eos_vi.html
Copyright 2011 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.8.3 (Build 4028) Charset: utf-8
wj8DBQFNfoXpS2KysvBH1xkRAiuiAJ9nyIgRIEiD4kYI7ZODRu/m0iJOQgCeIbKD J0gV3DRUWD3NMkMKC/ysvZE= =8K7w -----END PGP SIGNATURE-----
Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ .
For more information: SA40558
SOLUTION: Update to FishEye 2.3.3 and Crucible 2.3.3 or apply patches.
For more information: SA40558
SOLUTION: Fixed in the SVN repository. Document Title:
===============
LISTSERV Maestro Remote Code Execution Vulnerability
References (Source):
====================
https://www.securifera.com/advisories/sec-2020-0001/
https://www.lsoft.com/products/maestro.asp
Release Date:
=============
2020-10-20
Product & Service Introduction:
===============================
LISTSERV Maestro is an enterprise email marketing solution and allows you to easily engage your subscribers with targeted, intelligence-based opt-in campaigns. It offers easy tracking, reporting and list segmentation in a complete email marketing and analytics package.
Vulnerability Information:
==============================
Class: CWE-917 : Expression Language (EL) Injection
Impact: Remote Code Execution
Remotely Exploitable: Yes
Locally Exploitable: Yes
CVE Name: CVE-2010-1870
Vulnerability Description:
==============================
A unauthenticated remote code execution vulnerability was found in the LISTSERV Maestro software, version 9.0-8 and prior. This vulnerability stems from a known issue in struts, CVE-2010-1870, that allows for code execution via OGNL Injection. This vulnerability has been confirmed to be exploitable in both the Windows and Linux version of the software and has existed in the LISTSERV Maestro software since at least version 8.1-5. As a result, a specially crafted HTTP request can be constructed that executes code in the context of the web application. Exploitation of this vulnerability does not require authentication and can lead to root level privilege on any system running the LISTServ Maestro services.
Vulnerability Disclosure Timeline:
==================================
2020-10-12: Contact Vendor and Request Security Contact Info From Support Team
2020-10-12: Report Vulnerability Information to Vendor
2020-10-12: Vendor Confirms Submission
2020-10-13: Vendor Releases Patch
2020-10-13: Securifera Confirms With Vendor that the Patch Mitigates CVE-2010-1870 but suggest upgrading vulnerable struts library
2020-10-15: Vendor Approves Public Disclosure
Affected Product(s):
====================
LISTSERV Maestro 9.0-8 and prior
Severity Level:
===============
High
Proof of Concept (PoC):
=======================
A proof of concept will not be provided at this time.
Solution - Fix & Patch:
=======================
Temporary patch: https://dropbox.lsoft.us/download/LMA9.0-8-patch-2020-10-13.zip
Security Risk:
==============
The security risk of this remote code execution vulnerability is estimated as high. (CVSS 10.0)
Credits & Authors:
==================
Securifera, Inc - b0yd (@rwincey)
Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Securifera disclaims all
warranties, either expressed or implied,
including the warranties of merchantability and capability for a particular purpose. Securifera is not liable in any
case of damage,
including direct, indirect, incidental, consequential loss of business profits or special damages, even if Securifera
or its suppliers have been advised
of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential
or incidental damages so the foregoing
limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, or hack into any
systems.
Domains: www.securifera.com
Contact: contact [at] securifera [dot] com
Social: twitter.com/securifera
Copyright C 2020 | Securifera, Inc
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", affected_products: { "@id": "https://www.variotdbs.pl/ref/affected_products", }, configurations: { "@id": "https://www.variotdbs.pl/ref/configurations", }, credits: { "@id": "https://www.variotdbs.pl/ref/credits", }, cvss: { "@id": "https://www.variotdbs.pl/ref/cvss/", }, description: { "@id": "https://www.variotdbs.pl/ref/description/", }, exploit_availability: { "@id": "https://www.variotdbs.pl/ref/exploit_availability/", }, external_ids: { "@id": "https://www.variotdbs.pl/ref/external_ids/", }, iot: { "@id": "https://www.variotdbs.pl/ref/iot/", }, iot_taxonomy: { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/", }, patch: { "@id": "https://www.variotdbs.pl/ref/patch/", }, problemtype_data: { "@id": "https://www.variotdbs.pl/ref/problemtype_data/", }, references: { "@id": "https://www.variotdbs.pl/ref/references/", }, sources: { "@id": "https://www.variotdbs.pl/ref/sources/", }, sources_release_date: { "@id": "https://www.variotdbs.pl/ref/sources_release_date/", }, sources_update_date: { "@id": "https://www.variotdbs.pl/ref/sources_update_date/", }, threat_type: { "@id": "https://www.variotdbs.pl/ref/threat_type/", }, title: { "@id": "https://www.variotdbs.pl/ref/title/", }, type: { "@id": "https://www.variotdbs.pl/ref/type/", }, }, "@id": "https://www.variotdbs.pl/vuln/VAR-201008-0298", affected_products: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { model: "struts", scope: "eq", trust: 1.6, vendor: "apache", version: "2.1.0", }, { model: "struts", scope: "eq", trust: 1.6, vendor: "apache", version: "2.1.3", }, { model: "struts", scope: "eq", trust: 1.6, vendor: "apache", version: "2.1.6", }, { model: "struts", scope: "eq", trust: 1.6, vendor: "apache", version: "2.1.5", }, { model: "struts", scope: "eq", trust: 1.6, vendor: "apache", version: "2.1.2", }, { model: "struts", scope: "eq", trust: 1.6, vendor: "apache", version: "2.0.12", }, { model: "struts", scope: "eq", trust: 1.6, vendor: "apache", version: "2.1.4", }, { model: "struts", scope: "eq", trust: 1.6, vendor: "apache", version: "2.1.1", }, { model: "struts", scope: "eq", trust: 1.6, vendor: "apache", version: "2.1.8", }, { model: "struts", scope: "eq", trust: 1.6, vendor: "apache", version: "2.1.8.1", }, { model: "struts", scope: "eq", trust: 1, vendor: "apache", version: "2.0.10", }, { model: "struts", scope: "eq", trust: 1, vendor: "apache", version: "2.0.0", }, { model: "struts", scope: "eq", trust: 1, vendor: "apache", version: "2.0.2", }, { model: "struts", scope: "eq", trust: 1, vendor: "apache", version: "2.0.6", }, { model: "struts", scope: "eq", trust: 1, vendor: "apache", version: "2.0.11.1", }, { model: "struts", scope: "eq", trust: 1, vendor: "apache", version: "2.0.13", }, { model: "struts", scope: "eq", trust: 1, vendor: "apache", version: "2.0.1", }, { model: "struts", scope: "eq", trust: 1, vendor: "apache", version: "2.0.5", }, { model: "struts", scope: "eq", trust: 1, vendor: "apache", version: "2.0.4", }, { model: "struts", scope: "eq", trust: 1, vendor: "apache", version: "2.0.11.2", }, { model: "struts", scope: "eq", trust: 1, vendor: "apache", version: "2.0.11", }, { model: "struts", scope: "eq", trust: 1, vendor: "apache", version: "2.0.8", }, { model: "struts", scope: "eq", trust: 1, vendor: "apache", version: "2.0.14", }, { model: "struts", scope: "eq", trust: 1, vendor: "apache", version: "2.0.9", }, { model: "struts", scope: "eq", trust: 1, vendor: "apache", version: "2.0.3", }, { model: "struts", scope: "eq", trust: 1, vendor: "apache", version: "2.0.7", }, { model: "struts", scope: "eq", trust: 0.8, vendor: "apache", version: "2.0.0 to 2.1.8.1", }, { model: "alive enterprise", scope: "eq", trust: 0.8, vendor: "vmware", version: "7.2", }, { model: "vcenter orchestrator", scope: "eq", trust: 0.8, vendor: "vmware", version: "4.0 (windows)", }, { model: "vcenter orchestrator", scope: "eq", trust: 0.8, vendor: "vmware", version: "4.1 (windows)", }, { model: "business edition 3000", scope: null, trust: 0.8, vendor: "cisco", version: null, }, { model: "identity services engine", scope: null, trust: 0.8, vendor: "cisco", version: null, }, { model: "media experience engine", scope: "eq", trust: 0.8, vendor: "cisco", version: "3500", }, { model: "unified contact center enterprise", scope: null, trust: 0.8, vendor: "cisco", version: null, }, { model: "vcenter orchestrator", scope: "eq", trust: 0.3, vendor: "vmware", version: "4.1", }, { model: "vcenter orchestrator", scope: "eq", trust: 0.3, vendor: "vmware", version: "4.0", }, { model: "xwork", scope: "eq", trust: 0.3, vendor: "opensymphony", version: "2.1.5", }, { model: "xwork", scope: "eq", trust: 0.3, vendor: "opensymphony", version: "2.1", }, { model: "xwork", scope: "eq", trust: 0.3, vendor: "opensymphony", version: "2.0.6", }, { model: "xwork", scope: "eq", trust: 0.3, vendor: "opensymphony", version: "2.0.5", }, { model: "xwork", scope: "eq", trust: 0.3, vendor: "opensymphony", version: "2.0.4", }, { model: "xwork", scope: "eq", trust: 0.3, vendor: "opensymphony", version: "2.0.3", }, { model: "xwork", scope: "eq", trust: 0.3, vendor: "opensymphony", version: "2.0.2", }, { model: "xwork", scope: "eq", trust: 0.3, vendor: "opensymphony", version: "2.0.1", }, { model: "unified contact center enterprise", scope: "eq", trust: 0.3, vendor: "cisco", version: "0", }, { model: "fisheye", scope: "eq", trust: 0.3, vendor: "atlassian", version: "2.3.4", }, { model: "fisheye", scope: "eq", trust: 0.3, vendor: "atlassian", version: "2.2.3", }, { model: "crucible", scope: "eq", trust: 0.3, vendor: "atlassian", version: "2.3.2", }, { model: "crucible", scope: "eq", trust: 0.3, vendor: "atlassian", version: "2.2.3", }, { model: "software foundation struts", scope: "eq", trust: 0.3, vendor: "apache", version: "2.1.8.1", }, { model: "software foundation struts", scope: "eq", trust: 0.3, vendor: "apache", version: "2.1.8", }, { model: "software foundation struts", scope: "eq", trust: 0.3, vendor: "apache", version: "2.1.1", }, { model: "software foundation struts", scope: "eq", trust: 0.3, vendor: "apache", version: "2.1", }, { model: "software foundation struts", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.12", }, { model: "software foundation struts", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.11.2", }, { model: "software foundation struts", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.11.1", }, { model: "software foundation struts", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.9", }, { model: "software foundation struts", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.8", }, { model: "software foundation struts", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.7", }, { model: "software foundation struts", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.6", }, { model: "software foundation struts", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.5", }, { model: "software foundation struts", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.4", }, { model: "software foundation struts", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.3", }, { model: "software foundation struts", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.2", }, { model: "software foundation struts", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.1", }, { model: "software foundation struts", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0", }, { model: "software foundation archiva", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.4", }, { model: "software foundation archiva", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.3", }, { model: "software foundation archiva", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.1", }, { model: "software foundation archiva", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.5", }, { model: "software foundation archiva", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3", }, { model: "media experience engine", scope: "ne", trust: 0.3, vendor: "cisco", version: "56001.0", }, { model: "fisheye", scope: "ne", trust: 0.3, vendor: "atlassian", version: "2.3.1", }, { model: "crucible", scope: "ne", trust: 0.3, vendor: "atlassian", version: "2.3.3", }, { model: "software foundation struts", scope: "ne", trust: 0.3, vendor: "apache", version: "2.2", }, ], sources: [ { db: "BID", id: "41592", }, { db: "JVNDB", id: "JVNDB-2010-002831", }, { db: "NVD", id: "CVE-2010-1870", }, { db: "CNNVD", id: "CNNVD-201008-173", }, ], }, configurations: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", children: { "@container": "@list", }, cpe_match: { "@container": "@list", }, data: { "@container": "@list", }, nodes: { "@container": "@list", }, }, data: [ { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, ], }, ], sources: [ { db: "NVD", id: "CVE-2010-1870", }, ], }, credits: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "b0yd", sources: [ { db: "PACKETSTORM", id: "159643", }, { db: "CNNVD", id: "CNNVD-201008-173", }, ], trust: 0.7, }, cve: "CVE-2010-1870", cvss: { "@context": { cvssV2: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2", }, cvssV3: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/", }, severity: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#", }, "@id": "https://www.variotdbs.pl/ref/cvss/severity", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { cvssV2: [ { acInsufInfo: false, accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", author: "NVD", availabilityImpact: "NONE", baseScore: 5, confidentialityImpact: "NONE", exploitabilityScore: 10, impactScore: 2.9, integrityImpact: "PARTIAL", obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, severity: "MEDIUM", trust: 1, userInteractionRequired: false, vectorString: "AV:N/AC:L/Au:N/C:N/I:P/A:N", version: "2.0", }, { acInsufInfo: null, accessComplexity: "Low", accessVector: "Network", authentication: "None", author: "NVD", availabilityImpact: "None", baseScore: 5, confidentialityImpact: "None", exploitabilityScore: null, id: "CVE-2010-1870", impactScore: null, integrityImpact: "Partial", obtainAllPrivilege: null, obtainOtherPrivilege: null, obtainUserPrivilege: null, severity: "Medium", trust: 0.9, userInteractionRequired: null, vectorString: "AV:N/AC:L/Au:N/C:N/I:P/A:N", version: "2.0", }, ], cvssV3: [], severity: [ { author: "NVD", id: "CVE-2010-1870", trust: 1.8, value: "MEDIUM", }, { author: "CNNVD", id: "CNNVD-201008-173", trust: 0.6, value: "MEDIUM", }, { author: "VULMON", id: "CVE-2010-1870", trust: 0.1, value: "MEDIUM", }, ], }, ], sources: [ { db: "VULMON", id: "CVE-2010-1870", }, { db: "JVNDB", id: "JVNDB-2010-002831", }, { db: "NVD", id: "CVE-2010-1870", }, { db: "CNNVD", id: "CNNVD-201008-173", }, ], }, description: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the \"#\" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504. Used for multiple products Apache Struts of XWork In OGNL For the expression evaluation of \"#\" ParameterInterceptors A vulnerability exists that bypasses the protection mechanism. XWork is prone to a security-bypass vulnerability because it fails to adequately handle user-supplied input. \nAttackers can exploit this issue to manipulate server-side context objects with the privileges of the user running the application. Successful exploits can compromise the application and possibly the underlying computer. \nThis issue is related to the vulnerability documented in BID 32101 (XWork 'ParameterInterceptor' Class OGNL Security Bypass Vulnerability); the implemented solution appears to have been incomplete. The component uses the ParameterInterceptors directive to parse the Object-Graph Navigation Language (OGNL) expressions that are implemented via a whitelist feature. An attacker could exploit this vulnerability by sending crafted requests that contain OGNL expressions to an affected system. An exploit could allow the attacker to execute arbitrary code on the targeted system. \n\nCisco has released free software updates that address this vulnerability for all the affected products except Cisco Business Edition 3000 Series. Customers using Cisco Business Edition 3000 Series should contact their Cisco representative for available options. \n\nCisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available. ----------------------------------------------------------------------\n\n\nPassionate about writing secure code?\n\nhttp://secunia.com/company/jobs/open_positions/talented_programmer\n\n\nRead this if your favourite tool is a disassembler\n\nhttp://secunia.com/company/jobs/open_positions/reverse_engineer\n\n\n----------------------------------------------------------------------\n\nTITLE:\nXWork \"ParameterInterceptor\" Security Bypass Vulnerability\n\nSECUNIA ADVISORY ID:\nSA40558\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/40558/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory&vuln_id=40558\n\nRELEASE DATE:\n2010-07-13\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/40558/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/40558/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory&vuln_id=40558\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nA vulnerability has been reported in XWork, which can be exploited by\nmalicious people to bypass certain security restrictions. \n\nThe vulnerability is caused due to the \"ParameterInterceptor\" class\nimproperly restricting access to server-side objects. This can be\nexploited to modify server-side objects and e.g. \n\nThis is related to:\nSA32495\n\nSOLUTION:\nFilter malicious characters and character sequences using a proxy. \n\nPROVIDED AND/OR DISCOVERED BY:\nMeder Kydyraliev, Google Security Team\n\nORIGINAL ADVISORY:\nhttp://blog.o0o.nu/2010/07/cve-2010-1870-struts2xwork-remote.html\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n- ------------------------------------------------------------------------\n VMware Security Advisory\n\nAdvisory ID: VMSA-2011-0005\nSynopsis: VMware vCenter Orchestrator remote code execution\n vulnerability\nIssue date: 2011-03-14\nUpdated on: 2011-03-14 (initial release of advisory)\nCVE numbers: CVE-2010-1870\n- ------------------------------------------------------------------------\n\n1. Summary\n\n A vulnerability in VMware vCenter Orchestrator(vCO) could allow\n remote execution. \n\n2. Relevant releases\n\n VMware vCenter Orchestrator 4.1\n VMware vCenter Orchestrator 4.0\n\n3. Problem Description\n\n VMware vCenter Orchestrator is an application to automate\n management tasks. It embeds Apache Struts (version 2.0.11) which is\n a third party component. \n\n The following vulnerability has been reported in Apache Struts\n 2.0.11 or earlier. A remote execution of code vulnerability could\n allow malicious users to bypass the '#'-usage protection built into\n the ParametersInterceptor, which could allow server side context\n objects to be manipulated. \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org)\n has assigned the name CVE-2010-1870 to this vulnerability. \n\n VMware would like to thank the Vulnerability Research Team of\n Digital Defense, Inc. for reporting this issue to us. \n\n Apache Struts version 2.0.11 and earlier also contain\n vulnerabilities which have not been assigned CVE names. This\n advisory also addresses these vulnerabilities described at the\n following URLs:\n\n * http://struts.apache.org/2.2.1/docs/s2-002.html\n * http://struts.apache.org/2.2.1/docs/s2-003.html\n * http://struts.apache.org/2.2.1/docs/s2-004.html\n\n Column 4 of the following table lists the action required to\n remediate the vulnerability in each release, if a solution is\n available. \n\n VMware Product Running Replace with/\n Product Version on Apply Patch\n ============= ======== ======= =================\n vCO 4.1 Windows vCO fix for Apache Struts *\n vCO 4.0 Windows vCO fix for Apache Struts *\n\n * Refer to VMware Knowledge Base article 1034175 for a workaround. \n\n4. Solution\n\n Vmware vCenter Orchestrator\n ---------------------------\n vCenter Orchestrator workaround for Apache Struts\n http://kb.vmware.com/kb/1034175\n\n5. References\n\n CVE numbers\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1870\n\n- ------------------------------------------------------------------------\n6. Change log\n\n2011-03-14 VMSA-2011-0005\nInitial security advisory in conjunction with the release of an Apache\nStruts workaround for VMware vCenter Orchestrator on 2011-03-14. \n\n- ------------------------------------------------------------------------\n\n7. Contact\n\nE-mail list for product security notifications and announcements:\nhttp://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce\n\nThis Security Advisory is posted to the following lists:\n\n * security-announce at lists.vmware.com\n * bugtraq at securityfocus.com\n * full-disclosure at lists.grok.org.uk\n\nE-mail: security at vmware.com\nPGP key at: http://kb.vmware.com/kb/1055\n\nVMware Security Advisories\nhttp://www.vmware.com/security/advisories\n\nVMware security response policy\nhttp://www.vmware.com/support/policies/security_response.html\n\nGeneral support life cycle policy\nhttp://www.vmware.com/support/policies/eos.html\n\nVMware Infrastructure support life cycle policy\nhttp://www.vmware.com/support/policies/eos_vi.html\n\nCopyright 2011 VMware Inc. All rights reserved. \n\n-----BEGIN PGP SIGNATURE-----\nVersion: PGP Desktop 9.8.3 (Build 4028)\nCharset: utf-8\n\nwj8DBQFNfoXpS2KysvBH1xkRAiuiAJ9nyIgRIEiD4kYI7ZODRu/m0iJOQgCeIbKD\nJ0gV3DRUWD3NMkMKC/ysvZE=\n=8K7w\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nFull-Disclosure - We believe in it. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/\n. \n\nFor more information:\nSA40558\n\nSOLUTION:\nUpdate to FishEye 2.3.3 and Crucible 2.3.3 or apply patches. \n\nFor more information:\nSA40558\n\nSOLUTION:\nFixed in the SVN repository. Document Title:\n\n===============\n\nLISTSERV Maestro Remote Code Execution Vulnerability\n\n \n\nReferences (Source):\n\n====================\n\nhttps://www.securifera.com/advisories/sec-2020-0001/\n\nhttps://www.lsoft.com/products/maestro.asp\n\n \n\nRelease Date:\n\n=============\n\n2020-10-20\n\n \n\nProduct & Service Introduction:\n\n===============================\n\nLISTSERV Maestro is an enterprise email marketing solution and allows you to\neasily engage your subscribers with targeted, intelligence-based opt-in\ncampaigns. It offers easy tracking, reporting and list segmentation in a\ncomplete email marketing and analytics package. \n\n \n\n \n\nVulnerability Information:\n\n==============================\n\nClass: CWE-917 : Expression Language (EL) Injection\n\nImpact: Remote Code Execution\n\nRemotely Exploitable: Yes\n\nLocally Exploitable: Yes\n\nCVE Name: CVE-2010-1870\n\n \n\nVulnerability Description:\n\n==============================\n\nA unauthenticated remote code execution vulnerability was found in the\nLISTSERV Maestro software, version 9.0-8 and prior. This vulnerability stems\nfrom a known issue in struts, CVE-2010-1870, that allows for code execution\nvia OGNL Injection. This vulnerability has been confirmed to be exploitable\nin both the Windows and Linux version of the software and has existed in the\nLISTSERV Maestro software since at least version 8.1-5. As a result, a\nspecially crafted HTTP request can be constructed that executes code in the\ncontext of the web application. Exploitation of this vulnerability does not\nrequire authentication and can lead to root level privilege on any system\nrunning the LISTServ Maestro services. \n\n \n\nVulnerability Disclosure Timeline:\n\n==================================\n\n2020-10-12: Contact Vendor and Request Security Contact Info From Support\nTeam\n\n2020-10-12: Report Vulnerability Information to Vendor\n\n2020-10-12: Vendor Confirms Submission\n\n2020-10-13: Vendor Releases Patch\n\n2020-10-13: Securifera Confirms With Vendor that the Patch Mitigates\nCVE-2010-1870 but suggest upgrading vulnerable struts library\n\n2020-10-15: Vendor Approves Public Disclosure\n\n \n\n \n\nAffected Product(s):\n\n====================\n\nLISTSERV Maestro 9.0-8 and prior\n\n \n\nSeverity Level:\n\n===============\n\nHigh\n\n \n\nProof of Concept (PoC):\n\n=======================\n\nA proof of concept will not be provided at this time. \n\n \n\nSolution - Fix & Patch:\n\n=======================\n\nTemporary patch:\nhttps://dropbox.lsoft.us/download/LMA9.0-8-patch-2020-10-13.zip\n\n \n\nSecurity Risk:\n\n==============\n\nThe security risk of this remote code execution vulnerability is estimated\nas high. (CVSS 10.0)\n\n \n\nCredits & Authors:\n\n==================\n\nSecurifera, Inc - b0yd (@rwincey)\n\n \n\nDisclaimer & Information:\n\n=========================\n\nThe information provided in this advisory is provided as it is without any\nwarranty. Securifera disclaims all \n\nwarranties, either expressed or implied, \n\nincluding the warranties of merchantability and capability for a particular\npurpose. Securifera is not liable in any \n\ncase of damage, \n\nincluding direct, indirect, incidental, consequential loss of business\nprofits or special damages, even if Securifera \n\nor its suppliers have been advised \n\nof the possibility of such damages. Some states do not allow the exclusion\nor limitation of liability for consequential \n\nor incidental damages so the foregoing \n\nlimitation may not apply. We do not approve or encourage anybody to break\nany licenses, policies, or hack into any \n\nsystems. \n\n \n\nDomains: www.securifera.com\n\nContact: contact [at] securifera [dot] com\n\nSocial: twitter.com/securifera\n\n \n\nCopyright C 2020 | Securifera, Inc\n\n\n\n", sources: [ { db: "NVD", id: "CVE-2010-1870", }, { db: "JVNDB", id: "JVNDB-2010-002831", }, { db: "BID", id: "41592", }, { db: "VULMON", id: "CVE-2010-1870", }, { db: "PACKETSTORM", id: "127408", }, { db: "PACKETSTORM", id: "91733", }, { db: "PACKETSTORM", id: "99317", }, { db: "PACKETSTORM", id: "91735", }, { db: "PACKETSTORM", id: "91732", }, { db: "PACKETSTORM", id: "159643", }, ], trust: 2.52, }, exploit_availability: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { reference: "https://vulmon.com/exploitdetails?qidtp=exploitdb&qid=14360", trust: 0.2, type: "exploit", }, ], sources: [ { db: "VULMON", id: "CVE-2010-1870", }, ], }, external_ids: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { db: "NVD", id: "CVE-2010-1870", trust: 3.4, }, { db: "BID", id: "41592", trust: 2.8, }, { db: "OSVDB", id: "66280", trust: 2.5, }, { db: "PACKETSTORM", id: "159643", trust: 1.8, }, { db: "SECUNIA", id: "59110", trust: 1.7, }, { db: "EXPLOIT-DB", id: "14360", trust: 1.7, }, { db: "SREASON", id: "8345", trust: 1.7, }, { db: "JVNDB", id: "JVNDB-2010-002831", trust: 0.8, }, { db: "CNNVD", id: "CNNVD-201008-173", trust: 0.6, }, { db: "SECUNIA", id: "40558", trust: 0.2, }, { db: "SECUNIA", id: "40576", trust: 0.2, }, { db: "SECUNIA", id: "40575", trust: 0.2, }, { db: "VULMON", id: "CVE-2010-1870", trust: 0.1, }, { db: "PACKETSTORM", id: "127408", trust: 0.1, }, { db: "PACKETSTORM", id: "91733", trust: 0.1, }, { db: "PACKETSTORM", id: "99317", trust: 0.1, }, { db: "PACKETSTORM", id: "91735", trust: 0.1, }, { db: "PACKETSTORM", id: "91732", trust: 0.1, }, ], sources: [ { db: "VULMON", id: "CVE-2010-1870", }, { db: "BID", id: "41592", }, { db: "JVNDB", id: "JVNDB-2010-002831", }, { db: "PACKETSTORM", id: "127408", }, { db: "PACKETSTORM", id: "91733", }, { db: "PACKETSTORM", id: "99317", }, { db: "PACKETSTORM", id: "91735", }, { db: "PACKETSTORM", id: "91732", }, { db: "PACKETSTORM", id: "159643", }, { db: "NVD", id: "CVE-2010-1870", }, { db: "CNNVD", id: "CNNVD-201008-173", }, ], }, id: "VAR-201008-0298", iot: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: true, sources: [ { db: "VARIoT devices database", id: null, }, ], trust: 0.2, }, last_update_date: "2023-12-18T13:49:17.967000Z", patch: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { title: "CVE-2010-1870: Struts2 remote commands execution", trust: 0.8, url: "http://archiva.apache.org/security.html", }, { title: "S2-005", trust: 0.8, url: "http://struts.apache.org/2.2.1/docs/s2-005.html", }, { title: "cisco-sa-20140709-struts2", trust: 0.8, url: "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20140709-struts2", }, { title: "VMSA-2011-0005", trust: 0.8, url: "http://www.vmware.com/jp/support/support-resources/advisories/vmsa-2011-0005.html", }, { title: "cisco-sa-20140709-struts2", trust: 0.8, url: "http://www.cisco.com/cisco/web/support/jp/112/1122/1122766_cisco-sa-20140709-struts2-j.html", }, { title: "struts2-2.2.1-lib", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=40173", }, { title: "struts2-2.2.1-apps", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=40172", }, { title: "struts2-2.2.1-all", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=40171", }, { title: "struts2-2.2.1-src", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=40175", }, { title: "struts2-2.2.1-docs", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=40174", }, { title: "Cisco: Apache Struts 2 Command Execution Vulnerability in Multiple Cisco Products", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20140709-struts2", }, { title: "VMware Security Advisories: VMware vCenter Orchestrator and Alive Enterprise remote code execution vulnerability", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=vmware_security_advisories&qid=491bec6555e9512a68aa300b151531ed", }, { title: "Struts2_Bugs", trust: 0.1, url: "https://github.com/fupinglee/struts2_bugs ", }, { title: "vulmap", trust: 0.1, url: "https://github.com/zhzyker/vulmap ", }, { title: "The Register", trust: 0.1, url: "https://www.theregister.co.uk/2014/07/14/apache_patch_cisco_catches_up_with_ancient_struts2_vuln/", }, ], sources: [ { db: "VULMON", id: "CVE-2010-1870", }, { db: "JVNDB", id: "JVNDB-2010-002831", }, { db: "CNNVD", id: "CNNVD-201008-173", }, ], }, problemtype_data: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { problemtype: "NVD-CWE-Other", trust: 1, }, { problemtype: "CWE-DesignError", trust: 0.8, }, ], sources: [ { db: "JVNDB", id: "JVNDB-2010-002831", }, { db: "NVD", id: "CVE-2010-1870", }, ], }, references: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { trust: 2.5, url: "http://www.securityfocus.com/bid/41592", }, { trust: 2.3, url: "http://blog.o0o.nu/2010/07/cve-2010-1870-struts2xwork-remote.html", }, { trust: 2.3, url: "http://packetstormsecurity.com/files/159643/listserv-maestro-9.0-8-remote-code-execution.html", }, { trust: 2.1, url: "http://confluence.atlassian.com/display/fisheye/fisheye+security+advisory+2010-06-16", }, { trust: 1.8, url: "http://seclists.org/fulldisclosure/2020/oct/23", }, { trust: 1.8, url: "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20140709-struts2", }, { trust: 1.7, url: "http://seclists.org/fulldisclosure/2010/jul/183", }, { trust: 1.7, url: "http://secunia.com/advisories/59110", }, { trust: 1.7, url: "http://securityreason.com/securityalert/8345", }, { trust: 1.7, url: "http://struts.apache.org/2.2.1/docs/s2-005.html", }, { trust: 1.7, url: "http://www.exploit-db.com/exploits/14360", }, { trust: 1.7, url: "http://www.osvdb.org/66280", }, { trust: 0.9, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1870", }, { trust: 0.8, url: "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-1870", }, { trust: 0.8, url: "http://osvdb.org/66280", }, { trust: 0.4, url: "http://svn.apache.org/viewvc?view=revision&revision=956389", }, { trust: 0.3, url: "http://www.opensymphony.com/xwork/", }, { trust: 0.3, url: "https://nvd.nist.gov/vuln/detail/cve-2010-1870", }, { trust: 0.3, url: "http://secunia.com/products/corporate/evm/", }, { trust: 0.3, url: "http://secunia.com/advisories/secunia_security_advisories/", }, { trust: 0.3, url: "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/", }, { trust: 0.3, url: "http://secunia.com/company/jobs/open_positions/talented_programmer", }, { trust: 0.3, url: "http://secunia.com/vulnerability_scanning/personal/", }, { trust: 0.3, url: "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org", }, { trust: 0.3, url: "http://secunia.com/company/jobs/open_positions/reverse_engineer", }, { trust: 0.3, url: "http://secunia.com/advisories/about_secunia_advisories/", }, { trust: 0.1, url: "https://cwe.mitre.org/data/definitions/.html", }, { trust: 0.1, url: "https://www.rapid7.com/db/vulnerabilities/struts-cve-2010-1870", }, { trust: 0.1, url: "http://tools.cisco.com/security/center/viewalert.x?alertid=21731", }, { trust: 0.1, url: "https://nvd.nist.gov", }, { trust: 0.1, url: "https://www.exploit-db.com/exploits/14360/", }, { trust: 0.1, url: "https://www.rapid7.com/db/modules/exploit/multi/http/struts_code_exec", }, { trust: 0.1, url: "https://ca.secunia.com/?page=viewadvisory&vuln_id=40558", }, { trust: 0.1, url: "http://secunia.com/advisories/40558/", }, { trust: 0.1, url: "http://secunia.com/advisories/40558/#comments", }, { trust: 0.1, url: "http://kb.vmware.com/kb/1034175", }, { trust: 0.1, url: "http://struts.apache.org/2.2.1/docs/s2-003.html", }, { trust: 0.1, url: "http://secunia.com/", }, { trust: 0.1, url: "http://www.vmware.com/support/policies/security_response.html", }, { trust: 0.1, url: "http://kb.vmware.com/kb/1055", }, { trust: 0.1, url: "http://lists.grok.org.uk/full-disclosure-charter.html", }, { trust: 0.1, url: "http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce", }, { trust: 0.1, url: "http://struts.apache.org/2.2.1/docs/s2-002.html", }, { trust: 0.1, url: "http://struts.apache.org/2.2.1/docs/s2-004.html", }, { trust: 0.1, url: "http://www.vmware.com/support/policies/eos_vi.html", }, { trust: 0.1, url: "http://www.vmware.com/security/advisories", }, { trust: 0.1, url: "http://www.vmware.com/support/policies/eos.html", }, { trust: 0.1, url: "http://secunia.com/advisories/40576/", }, { trust: 0.1, url: "https://ca.secunia.com/?page=viewadvisory&vuln_id=40576", }, { trust: 0.1, url: "http://secunia.com/advisories/40576/#comments", }, { trust: 0.1, url: "http://secunia.com/advisories/40575/#comments", }, { trust: 0.1, url: "http://secunia.com/advisories/40575/", }, { trust: 0.1, url: "https://ca.secunia.com/?page=viewadvisory&vuln_id=40575", }, { trust: 0.1, url: "https://dropbox.lsoft.us/download/lma9.0-8-patch-2020-10-13.zip", }, { trust: 0.1, url: "https://www.lsoft.com/products/maestro.asp", }, { trust: 0.1, url: "https://www.securifera.com/advisories/sec-2020-0001/", }, ], sources: [ { db: "VULMON", id: "CVE-2010-1870", }, { db: "BID", id: "41592", }, { db: "JVNDB", id: "JVNDB-2010-002831", }, { db: "PACKETSTORM", id: "127408", }, { db: "PACKETSTORM", id: "91733", }, { db: "PACKETSTORM", id: "99317", }, { db: "PACKETSTORM", id: "91735", }, { db: "PACKETSTORM", id: "91732", }, { db: "PACKETSTORM", id: "159643", }, { db: "NVD", id: "CVE-2010-1870", }, { db: "CNNVD", id: "CNNVD-201008-173", }, ], }, sources: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", data: { "@container": "@list", }, }, data: [ { db: "VULMON", id: "CVE-2010-1870", }, { db: "BID", id: "41592", }, { db: "JVNDB", id: "JVNDB-2010-002831", }, { db: "PACKETSTORM", id: "127408", }, { db: "PACKETSTORM", id: "91733", }, { db: "PACKETSTORM", id: "99317", }, { db: "PACKETSTORM", id: "91735", }, { db: "PACKETSTORM", id: "91732", }, { db: "PACKETSTORM", id: "159643", }, { db: "NVD", id: "CVE-2010-1870", }, { db: "CNNVD", id: "CNNVD-201008-173", }, ], }, sources_release_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", data: { "@container": "@list", }, }, data: [ { date: "2010-08-17T00:00:00", db: "VULMON", id: "CVE-2010-1870", }, { date: "2010-07-13T00:00:00", db: "BID", id: "41592", }, { date: "2011-06-09T00:00:00", db: "JVNDB", id: "JVNDB-2010-002831", }, { date: "2014-07-09T17:20:53", db: "PACKETSTORM", id: "127408", }, { date: "2010-07-13T05:27:52", db: "PACKETSTORM", id: "91733", }, { date: "2011-03-15T01:37:07", db: "PACKETSTORM", id: "99317", }, { date: "2010-07-13T05:27:58", db: "PACKETSTORM", id: "91735", }, { date: "2010-07-13T05:27:50", db: "PACKETSTORM", id: "91732", }, { date: "2020-10-20T20:17:41", db: "PACKETSTORM", id: "159643", }, { date: "2010-08-17T20:00:03.407000", db: "NVD", id: "CVE-2010-1870", }, { date: "2010-08-27T00:00:00", db: "CNNVD", id: "CNNVD-201008-173", }, ], }, sources_update_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", data: { "@container": "@list", }, }, data: [ { date: "2020-10-20T00:00:00", db: "VULMON", id: "CVE-2010-1870", }, { date: "2014-09-01T01:23:00", db: "BID", id: "41592", }, { date: "2015-08-11T00:00:00", db: "JVNDB", id: "JVNDB-2010-002831", }, { date: "2020-10-20T22:15:15.390000", db: "NVD", id: "CVE-2010-1870", }, { date: "2020-10-21T00:00:00", db: "CNNVD", id: "CNNVD-201008-173", }, ], }, threat_type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "remote", sources: [ { db: "PACKETSTORM", id: "127408", }, { db: "PACKETSTORM", id: "99317", }, { db: "PACKETSTORM", id: "159643", }, { db: "CNNVD", id: "CNNVD-201008-173", }, ], trust: 0.9, }, title: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Apache Struts of XWork Vulnerabilities that bypass object protection mechanisms", sources: [ { db: "JVNDB", id: "JVNDB-2010-002831", }, ], trust: 0.8, }, type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "other", sources: [ { db: "CNNVD", id: "CNNVD-201008-173", }, ], trust: 0.6, }, }