Insecure Direct Object Reference in Atlassian Fisheye and Crucible
CVE-2020-29446

5.3MEDIUM

Key Information:

Vendor

Atlassian
Status
Fisheye
Crucible
Vendor
CVE Published:
18 January 2021

What is CVE-2020-29446?

The vulnerability identified in certain versions of Atlassian Fisheye and Crucible consists of an Insecure Direct Object Reference (IDOR) that enables remote attackers to access local files through the WEB-INF directory. This exposure occurs in versions prior to 4.8.5, allowing unauthorized data access that can lead to further security breaches.

Affected Version(s)

Crucible < 4.8.5

Fisheye < 4.8.5

References

https://jira.atlassian.com/browse/CRUC-8496
x_refsource_MISC
https://jira.atlassian.com/browse/FE-7326
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2020-29446 : Insecure Direct Object Reference in Atlassian Fisheye and Crucible