Atlassian Vulnerabilities and Affected Products
Vulnerabilities associated with Fisheye and Crucible.
Products
Clear product- Jira Server99 vulnerabilities
- Jira Data Center64 vulnerabilities
- Jira52 vulnerabilities
- Confluence Server38 vulnerabilities
- Confluence Data Center35 vulnerabilities
- Crucible29 vulnerabilities
- Fisheye27 vulnerabilities
- jira_data_center26 vulnerabilities
- jira_server25 vulnerabilities
- Jira Server and Data Center21 vulnerabilities
- Bitbucket Server18 vulnerabilities
- Crowd16 vulnerabilities
- Fisheye and Crucible16 vulnerabilities
- Bamboo15 vulnerabilities
- Jira Service Management Data Center14 vulnerabilities
- Bitbucket Data Center13 vulnerabilities
- Jira Align13 vulnerabilities
- Jira Service Management Server13 vulnerabilities
- Confluence Server and Data Center12 vulnerabilities
- confluence_data_center12 vulnerabilities
- confluence_server10 vulnerabilities
- Bamboo Data Center8 vulnerabilities
- Sourcetree for Windows8 vulnerabilities
- Confluence7 vulnerabilities
- Bamboo Server6 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2018-20241MEDIUM | The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the wbuser parameter. CWE-79Feb 20, 2019 | CVSS5.4v3.0 | EPSS0.904% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-20240MEDIUM | The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter. CWE-79Feb 20, 2019 | CVSS4.8v3.0 | EPSS0.889% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-13399HIGH | The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory. CWE-732Oct 16, 2018 | CVSS7.8v3.0 | EPSS0.256% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-13398MEDIUM | The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery (CSRF) vulnerability. CWE-352Sep 18, 2018 | CVSS6.5v3.0 | EPSS0.534% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-13392MEDIUM | Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in linked issue keys. CWE-79Aug 13, 2018 | CVSS6.1v3.0 | EPSS1.68% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-13388MEDIUM | The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in attached files. CWE-79Jul 10, 2018 | CVSS5.4v3.0 | EPSS0.861% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-16859MEDIUM | The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parameter. CWE-22Jun 28, 2018 | CVSS6.5v3.0 | EPSS2.53% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-5228MEDIUM | The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers. CWE-79Apr 24, 2018 | CVSS6.1v3.0 | EPSS1.21% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-5223HIGH | Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible on the Windows operating system. All versions of Fisheye and Crucible before 4.4.6 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.3 (the fixed versio… CWE-20Mar 29, 2018 | CVSS7.2v3.0 | EPSS2.12% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-18094MEDIUM | Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the base path setting of a configured file system repository. CWE-79Mar 22, 2018 | CVSS4.8v3.0 | EPSS0.617% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-18093MEDIUM | Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the location setting of a configured repository. CWE-79Feb 19, 2018 | CVSS4.8v3.0 | EPSS0.841% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-18091MEDIUM | The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup. CWE-79Feb 16, 2018 | CVSS4.8v3.0 | EPSS0.841% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-18035MEDIUM | The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistics for it. | CVSS4.3v3.0 | EPSS0.788% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-18034MEDIUM | The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch. CWE-79Feb 2, 2018 | CVSS5.4v3.0 | EPSS0.586% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-16861CRITICAL | It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fisheye or Crucible or who hosts a website that a user who can access the web interface of Fisheye or Crucible visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Fisheye or Crucible. All versions of Fisheye and Crucible before 4.4.5 (the fixed vers… Feb 1, 2018 | CVSS9.8v3.0 | EPSS1.95% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-14591CRITICAL | Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software. CWE-88Nov 29, 2017 | CVSS9.0v3.0 | EPSS2.31% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |