• Type: Bug
• Resolution: Fixed
• Priority: Low
• Fix Version/s: 4.4.1
• Affects Version/s: None
• Component/s: None
• Labels:

  • CVE-2017-9512
  • advisory-released
  • basm
  • cvss-medium
  • security

[CRUC-8053] mostActiveCommitters.do lacks permission checks - CVE-2017-9512

Said made changes - 31/Dec/2019 2:59 AM

Labels

Original: CVE-2017-9512 advisory-released cvss-medium security

New: CVE-2017-9512 advisory-released basm cvss-medium security

Owen made changes - 16/Oct/2018 8:14 AM

Workflow

Original: FE-CRUC Bug Workflow [ 2941990 ]

New: JAC Bug Workflow v3 [ 2954369 ]

Owen made changes - 16/Oct/2018 4:41 AM

Workflow

Original: FECRU Development Workflow - Triage - Restricted [ 2409601 ]

New: FE-CRUC Bug Workflow [ 2941990 ]

David Black made changes - 29/Jan/2018 6:31 AM

Remote Link

Original: This issue links to "Page (Extranet)" [ 314234 ]

David Black made changes - 24/Aug/2017 11:41 AM

Description

Original: The mostActiveCommitters.do resource in Atlassian FishEye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses and other committer information, as it lacked permission checks.

New: The mostActiveCommitters.do resource in Atlassian FishEye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks.

David Black made changes - 24/Aug/2017 11:40 AM

Labels

Original: advisory-released cvss-medium security

New: CVE-2017-9512 advisory-released cvss-medium security

David Black made changes - 24/Aug/2017 11:40 AM

Summary

Original: mostActiveCommitters.do available to anonymous users

New: mostActiveCommitters.do lacks permission checks - CVE-2017-9512

David Black made changes - 24/Aug/2017 11:38 AM

Description

Original: Anonymous users have access to the mostActiveCommitters.do which leaks some sensitive information (such as email addresses).

New: The mostActiveCommitters.do resource in Atlassian FishEye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses and other committer information, as it lacked permission checks.

David Black made changes - 18/Aug/2017 6:49 AM

Remote Link

New: This issue links to "Page (Extranet)" [ 314234 ]

Piotr Swiecicki made changes - 09/Aug/2017 7:35 AM

Labels

Original: advisory-released cvss-medium fecru-published security

New: advisory-released cvss-medium security

Load more older history items