Improper Authentication Limitations in Atlassian Fisheye and Crucible

CVE-2021-43958

What is CVE-2021-43958?

In versions prior to 4.8.9 of Atlassian Fisheye and Crucible, various REST resources did not enforce limits on failed login attempts. This flaw allows remote attackers to exploit the system by repeatedly attempting to guess user credentials without hitting a maximum threshold. As a result, attackers could bypass expected security measures, such as CAPTCHA challenges that are intended to prevent automated access. Organizations using these applications are advised to update to the latest versions to mitigate the risk of unauthorized access.

References