Uploaded image for project: 'FishEye'
  1. FishEye
  2. FE-4965

Privilege escalation

    XMLWordPrintable

    Details

      Description

      We have identified and fixed a vulnerability in FishEye which allowed unauthenticated users to commit actions on behalf of any other authorised user. In order to exploit this vulnerability, an attacker requires access to your FishEye web interface.

      FishEye server is only vulnerable if it has been configured to be a part of an Application link with Trusted Applications authentication.

      The vulnerability affects all supported versions of FishEye up to and including 3.1.5. It has been fixed in 3.2.0, 3.1.6 and 2.10.8.

      For more information, see our security advisory.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              Unassigned
              Reporter:
              rbattaglin Renan Battaglin
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: