[FE-6892] mostActiveCommitters.do lacks permission checks - CVE-2017-9512 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Low
Fix Version/s: 4.4.1
Affects Version/s: None
Component/s: None
Labels:

Symptom Severity:
Severity 3 - Minor
Bug Fix Policy:
View Atlassian Server bug fix policy

The mostActiveCommitters.do resource in Atlassian FishEye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks.

was cloned as

CRUC-8053 mostActiveCommitters.do lacks permission checks - CVE-2017-9512

Closed

Assignee:: Unassigned

Reporter:: Piotr Swiecicki

Affected customers:: 0 This affects my team

Watchers:: 1 Start watching this issue

Created:: 17/Jul/2017 9:06 AM

Updated:: 20/Dec/2019 5:08 AM

Resolved:: 17/Jul/2017 9:07 AM

Details

Description

Attachments

Issue Links

Forms

Activity

People

Dates