Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: Atlassian Crucible, Fisheye 4.8.9 Clear all filters
TI-2021-19720 CVE-2021-43958 · GHSA-j832-43w3-m333

Missing brute-force protection in Atlassian Fisheye

Priority MEDIUM 52

Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and th…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01465 Published 2022-03-16 Fixed in 4.8.9 CWE-307
TI-2021-19719 CVE-2021-43957 · GHSA-wg3j-ppp5-jg9q

Authorization bypass in Atlassian Fisheye

Priority MEDIUM 41

Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-2944…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01295 Published 2022-03-16 Fixed in 4.8.9 CWE-639
TI-2021-19718 CVE-2021-43956 · GHSA-9p4g-cjcf-q3x2

Prototype pollution in Atlassian Fisheye

Priority LOW 29

The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00731 Published 2022-03-16 Fixed in 4.8.9 CWE-1321
TI-2021-19717 CVE-2021-43955 · GHSA-r38x-qwc8-xv5f

The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9…

Priority LOW 22

The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about installation directories via information disclosure vulnerability…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00875 Published 2022-03-16 Fixed in 4.8.9