Cross-Site Request Forgery in Atlassian Fisheye and Crucible Setup Process
CVE-2020-4018

8.8HIGH

Key Information:

Vendor
Atlassian
Status
Crucible
Fisheye
Vendor
CVE Published:
1 June 2020

Summary

The setup resources in Atlassian Fisheye and Crucible prior to version 4.8.1 contain a cross-site request forgery (CSRF) vulnerability that allows unauthorized remote attackers to manipulate the setup process. This security flaw can potentially lead to an unauthorized completion of the setup, affecting the integrity and security of the applications.

Affected Version(s)

Crucible < 4.8.1

Fisheye < 4.8.1

References

https://jira.atlassian.com/browse/FE-7287
x_refsource_MISC
https://jira.atlassian.com/browse/CRUC-8471
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.