CVE-2020-29446
published 2021-01-18CVE-2020-29446: Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
1.14%
62.9th percentile
Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory. The affected versions are before version 4.8.5.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| atlassian | crucible | < 4.8.9 | 4.8.9 |
| atlassian | crucible | < 4.8.5 | 4.8.5 |
| atlassian | crucible | >= unspecified < 4.8.9 | 4.8.9 |
| atlassian | fisheye | < 4.8.9 | 4.8.9 |
| atlassian | fisheye | < 4.8.5 | 4.8.5 |
| atlassian | fisheye | >= unspecified < 4.8.9 | 4.8.9 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-73qx-v778-p382: Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnera
ghsa_unreviewed·2022-05-24
CVE-2020-29446 [MEDIUM] CWE-200 GHSA-73qx-v778-p382: Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnera
Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory. The affected versions are before version 4.8.5.
GHSA
GHSA-wg3j-ppp5-jg9q: Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulne
ghsa_unreviewed·2022-03-17·CVSS 5.3
CVE-2021-43957 [MEDIUM] CWE-639 GHSA-wg3j-ppp5-jg9q: Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulne
Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-01-18
Published