CVE-2017-18035: The /rest/review-coverage-chart/1.0/data//.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this…

medium4.3CVSS 3.0

AVNACLPRLUINSUCLINAN

The /rest/review-coverage-chart/1.0/data//.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistics for it.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
atlassian	crucible	< 4.5.1	4.5.1
atlassian	fisheye	< 4.5.1	4.5.1
atlassian	fisheye_and_crucible	—	—