Read the docs
TI-2017-06919 Aliases CVE-2017-9512GHSA-fp8m-5h9q-mjmp

Information disclosure in Atlassian Fisheye and Crucible

Priority MEDIUM 43CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-200.

Summary

The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0197 80th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianAtlassian Fisheye and CrucibleAll versions prior to version 4.4.1—No fix listedCNA
  • Atlassian Fisheye and Crucible VendorAtlassian Affected All versions prior to version 4.4.1 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*up to 4.4.0VulnerableAtlassian
cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*up to 4.4.0VulnerableAtlassian
  • cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:* Versions up to 4.4.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:* Versions up to 4.4.0 Vulnerable ·Atlassian

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-9512
  2. 2026-10-03 Alias added: GHSA-fp8m-5h9q-mjmp

References

Advisory 2

  • TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
  • TI-2024-14399 Code injection in Atlassian Confluence Data Center CVSS 3.1HIGH 8.8
  • TI-2012-02540 Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before… CVSS 3.1CRITICAL 9.1
  • TI-2022-09598 Improper authentication in Atlassian Bamboo Server CVSS 3.1CRITICAL 9.8
  • TI-2021-19720 Missing brute-force protection in Atlassian Fisheye CVSS 3.1CRITICAL 9.8
  • TI-2017-12407 It was possible for double OGNL evaluation in certain redirect action and in WebWork URL… CVSS 3.0CRITICAL 9.8
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences