[FE-5208] Administrator password reset

Type: Bug
Resolution: Fixed
Priority: High
Fix Version/s: 3.0.4, 3.2.5, 3.1.7, 3.3.4, 3.4.4
Affects Version/s: None
Component/s: None
Labels:
- cvss-critical
- security

Bug Fix Policy:
View Atlassian Server bug fix policy

An unauthenticated user is able to set the admin password of FishEye to any value, gaining admin access to the FishEye instance as a result.

The vulnerability affects FishEye version 3.x. Versions earlier than 3.0 are not vulnerable. The vulnerability has been fixed in recent releases 3.0.4, 3.1.7, 3.2.5, 3.3.4, 3.4.4, 3.5.0.

For additional details see the full advisory

mentioned in: Page No Confluence page found with the given URL.; Page No Confluence page found with the given URL.; Page No Confluence page found with the given URL.; Page No Confluence page found with the given URL.; Page No Confluence page found with the given URL.; Page Loading...; Page Loading...; Page Loading...; Page Loading...; Page Loading...; Page Loading...; Page Loading...; Page Loading...; Page Loading...; Page Loading...

(10 mentioned in)

Assignee:: Conor (Inactive)

Reporter:: VitalyA

Affected customers:: 0 This affects my team

Watchers:: 3 Start watching this issue

Created:: 14/May/2014 4:04 AM

Updated:: 12/Oct/2017 10:36 AM

Resolved:: 21/May/2014 12:41 PM

FishEye

Details

Description

Attachments

Issue Links

Forms

Activity

People

Dates