CVE-2018-13398 — Cross-Site Request Forgery in Atlassian Fisheye AND Crucible

CWE-352 — Cross-Site Request Forgery3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 66.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Atlassian Fisheye AND CrucibleAtlassian CrucibleAtlassian Fisheye
Timeline
PublishedSep 18
Latest updateMay 14

Description

The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery (CSRF) vulnerability.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5atlassian/fisheye_and_crucibleunspecified — 4.5.4
▶NVDatlassian/fisheye< 4.5.4
▶NVDatlassian/crucible< 4.5.4

🔴Vulnerability Details

2
GHSA
GHSA-9xj3-f33j-rv5m: The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4↗2022-05-14
▶
CVEList
CVE-2018-13398: The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4↗2018-09-18
▶
CVE-2018-13398 — Cross-Site Request Forgery | cvebase