TI-2021-19716 Aliases CVE-2021-43954 GHSA-w6c2-26pj-hpq6

Server-side request forgery in Atlassian Fisheye

LOW 21CWE-918Published 2022-03-14 · Updated 2024-10-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00766 55th percentileScored 2026-11-07

Fix Fixed Fisheye (Atlassian): 4.8.9Crucible (Atlassian): 4.8.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Atlassian	Fisheye	before 4.8.9	4.8.9	Patch available	CNA
Atlassian	Crucible	before 4.8.9	4.8.9	Patch available	CNA

Fisheye VendorAtlassian Affected before 4.8.9 Fixed in 4.8.9 Patch available CNA
Crucible VendorAtlassian Affected before 4.8.9 Fixed in 4.8.9 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:atlassian:crucible::::::::	before 4.8.9	Vulnerable	Atlassian
cpe:2.3:a:atlassian:fisheye::::::::	before 4.8.9	Vulnerable	Atlassian

cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:* Versions before 4.8.9 Vulnerable ·Atlassian
cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:* Versions before 4.8.9 Vulnerable ·Atlassian

Remediation

Fix · CNA Fisheye (Atlassian) Fixed in 4.8.9
Fix · CNA Crucible (Atlassian) Fixed in 4.8.9

Timeline

2026-10-02 Threatist record created from CVE-2021-43954
2026-10-03 Alias added: GHSA-w6c2-26pj-hpq6

References

Advisory 2

TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
TI-2024-14399 Code injection in Atlassian Confluence Data Center CVSS 3.1HIGH 8.8
TI-2012-02540 Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before… CVSS 3.1CRITICAL 9.1
TI-2022-09598 Improper authentication in Atlassian Bamboo Server CVSS 3.1CRITICAL 9.8
TI-2021-19720 Missing brute-force protection in Atlassian Fisheye CVSS 3.1CRITICAL 9.8
TI-2017-12407 It was possible for double OGNL evaluation in certain redirect action and in WebWork URL… CVSS 3.0CRITICAL 9.8

See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences