[%22Third] The administrative smart-commits resource was vulnerable to Cross-site request forgery (CSRF) - CVE-2018-13398 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Medium
Fix Version/s: 4.6.0, 4.5.4
Affects Version/s: 4.5.3
Component/s: None
Labels:
- CVE-2018-13398
- advisory
- advisory-released
- bugbounty
- csrf
- cvss-medium
- security
- xsrf

Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery (CSRF) vulnerability.

relates to

FE-7100 The administrative smart-commits resource was vulnerable to Cross-site request forgery (CSRF) - CVE-2018-13398

Closed

No work has yet been logged on this issue.

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Affected customers:: 0 This affects my team

Watchers:: 1 Start watching this issue

Created:: 17/Sep/2018 12:47 PM

Updated:: 17/Sep/2018 1:11 PM

Resolved:: 17/Sep/2018 12:48 PM

Details

Description

Attachments

Issue Links

Forms

Activity

[CRUC-8312] The administrative smart-commits resource was vulnerable to Cross-site request forgery (CSRF) - CVE-2018-13398

People

Dates