CVE-2020-29447

CWE-434 — Unrestricted File Upload3 documents3 sources

Severity

4.3MEDIUM

EPSS

0.4%

top 36.86%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Atlassian Crucible

Timeline

PublishedDec 21

Latest updateMay 24

Description

Affected versions of Atlassian Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the file upload request feature of code reviews. The affected versions are before version 4.7.4, and from version 4.8.0 before 4.8.5.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5atlassian/crucibleunspecified — 4.7.4+2

▶NVDatlassian/crucible4.8.0 — 4.8.5+1

🔴Vulnerability Details

GHSA

GHSA-cj8v-r5w4-97v8: Affected versions of Atlassian Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in↗2022-05-24

▶

CVEList

CVE-2020-29447: Affected versions of Atlassian Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in↗2020-12-21

▶