CVE-2020-4026

4.3MEDIUM

Key Information:

Vendor
Atlassian
Status
Navigator Links
Crucible
Fisheye
Vendor
CVE Published:
3 June 2020

Summary

The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from version 5.0.0 before 5.0.1, and from version 5.1.0 before 5.1.1 allows remote attackers to enumerate all linked applications, including those that are restricted or otherwise hidden, through an incorrect authorization check.

Affected Version(s)

Crucible < 4.8.2

Fisheye < 4.8.2

Navigator Links < 3.2.23

References

https://jira.atlassian.com/browse/FE-7299
x_refsource_MISC
https://jira.atlassian.com/browse/CRUC-8485
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.