Uploaded image for project: 'FishEye'
  1. FishEye
  2. FE-7299

The bundled version of Atlassian Navigator Links contained an incorrect authorization check - CVE-2020-4026

XMLWordPrintable

      The bundled version of Atlassian Navigator Links plugin in Atlassian Fisheye before version 4.8.2 allows remote attackers to enumerate all linked applications, including those that are restricted or otherwise hidden, through an incorrect authorization check. Additional details about the issue in the Atlassian Navigator Links plugin can be found below.

      The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from version 5.0.0 before 5.0.1, and from version 5.1.0 before 5.1.1 allows remote attackers to enumerate all linked applications, including those that are restricted or otherwise hidden, through an incorrect authorization check.

            [FE-7299] The bundled version of Atlassian Navigator Links contained an incorrect authorization check - CVE-2020-4026

            Marek Parfianowicz made changes -
            Labels Original: CVE-2020-4026 advisory advisory-released cvss-medium release-48x release-490 security vulnerable-components New: CVE-2020-4026 advisory advisory-released cvss-medium release-48x security vulnerable-components
            Marek Parfianowicz made changes -
            Labels Original: CVE-2020-4026 advisory advisory-released cvss-medium release-490 security vulnerable-components New: CVE-2020-4026 advisory advisory-released cvss-medium release-48x release-490 security vulnerable-components
            Marek Parfianowicz made changes -
            Labels Original: CVE-2020-4026 advisory advisory-released cvss-medium security vulnerable-components New: CVE-2020-4026 advisory advisory-released cvss-medium release-490 security vulnerable-components
            Marek Parfianowicz made changes -
            Fix Version/s Original: 4.9.0 [ 90694 ]
            David Black made changes -
            Link New: This issue is related to CRUC-8485 [ CRUC-8485 ]
            David Black made changes -
            Link Original: This issue was cloned as CRUC-8485 [ CRUC-8485 ]
            David Black made changes -
            Labels Original: CVE-2020-4026 advisory advisory-to-release cvss-medium security vulnerable-components New: CVE-2020-4026 advisory advisory-released cvss-medium security vulnerable-components
            David Black made changes -
            Security Original: Reporter and Atlassian Staff [ 10751 ]
            David Black made changes -
            Comment [ A comment with security level 'atlassian-staff' was removed. ]
            David Black made changes -
            Link New: This issue was cloned as FE-7300 [ FE-7300 ]

              Unassigned Unassigned
              security-metrics-bot Security Metrics Bot
              Affected customers:
              0 This affects my team
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: