Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-43954

The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
atlassian

Description

The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Atlassian Fisheye

  • unspecified to < 4.8.9affected

Atlassian Crucible

  • unspecified to < 4.8.9affected

References