CVE-2021-43958

published 2022-03-16

CVE-2021-43958: Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not…

Priority P2 59 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and therefore required solving a CAPTCHA in addition to providing user credentials for authentication via a improper restriction of excess authentication attempts vulnerability.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
atlassian	crucible	< 4.8.9	4.8.9
atlassian	crucible	>= unspecified < 4.8.9	4.8.9
atlassian	fisheye	< 4.8.9	4.8.9
atlassian	fisheye	>= unspecified < 4.8.9	4.8.9

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-307