Uploaded image for project: 'Crucible'
  1. Crucible
  2. CRUC-6662

Privilege escalation

XMLWordPrintable

      We have identified and fixed a vulnerability in Crucible which allowed unauthenticated users to commit actions on behalf of any other authorised user. In order to exploit this vulnerability, an attacker requires access to your Crucible web interface.

      A Crucible server is only vulnerable if it has been configured to be a part of an Application link with Trusted Applications authentication.

      The vulnerability affects all supported versions of Crucible up to and including 3.1.5 and 2.10.7. It has been fixed in 3.2.0, 3.1.6 and 2.10.8.

      For more information, see our security advisory.

            [CRUC-6662] Privilege escalation

            Rachel Robins made changes -
            Remote Link Original: This issue links to "Page (Atlassian Documentation)" [ 228152 ]
            Owen made changes -
            Workflow Original: FE-CRUC Bug Workflow [ 2941574 ] New: JAC Bug Workflow v3 [ 2953142 ]
            Owen made changes -
            Workflow Original: FECRU Development Workflow - Triage - Restricted [ 1511463 ] New: FE-CRUC Bug Workflow [ 2941574 ]
            Rachel Robins made changes -
            Remote Link Original: This issue links to "Page (Atlassian Documentation)" [ 228152 ] New: This issue links to "Page (Atlassian Documentation)" [ 228152 ]
            Rachel Robins made changes -
            Remote Link New: This issue links to "Page (Atlassian Documentation)" [ 228152 ]
            paulwatson (Inactive) made changes -
            Remote Link Original: This issue links to "Page (Atlassian Documentation)" [ 200473 ] New: This issue links to "Page (Atlassian Documentation)" [ 200473 ]
            paulwatson (Inactive) made changes -
            Remote Link New: This issue links to "Page (Atlassian Documentation)" [ 200473 ]
            Owen made changes -
            Workflow Original: FECRU Development Workflow - Triage [ 939946 ] New: FECRU Development Workflow - Triage - Restricted [ 1511463 ]
            paulwatson (Inactive) made changes -
            Remote Link Original: This issue links to "Page (Atlassian Documentation)" [ 180980 ] New: This issue links to "Page (Atlassian Documentation)" [ 180980 ]
            paulwatson (Inactive) made changes -
            Remote Link New: This issue links to "Page (Atlassian Documentation)" [ 180980 ]

              Unassigned Unassigned
              rbattaglin Renan Battaglin
              Affected customers:
              0 This affects my team
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: