• Type: Public Security Vulnerability
• Resolution: Fixed
• Priority: Low
• Fix Version/s: 4.8.9
• Affects Version/s: 4.8.0
• Component/s: None
• Labels:

  • CVE-2021-43954
  • advisory
  • advisory-released
  • dont-import
  • release-48x
  • security

[FE-7384] CVE-2021-43954: File and network resource enumeration via SSRF in DefaultRepositoryAdminService

Marek Parfianowicz made changes - 09/Nov/2023 9:44 AM

Labels

Original: CVE-2021-43954 advisory advisory-released dont-import release-48x release-490 security

New: CVE-2021-43954 advisory advisory-released dont-import release-48x security

Marek Parfianowicz made changes - 09/Nov/2023 9:43 AM

Labels

Original: CVE-2021-43954 advisory advisory-released dont-import release-490 security

New: CVE-2021-43954 advisory advisory-released dont-import release-48x release-490 security

Marek Parfianowicz made changes - 09/May/2023 5:48 PM

Labels

Original: CVE-2021-43954 advisory advisory-released dont-import security

New: CVE-2021-43954 advisory advisory-released dont-import release-490 security

Security Metrics Bot made changes - 20/Mar/2022 8:28 PM

CVE ID

New: CVE-2021-43954

David Black made changes - 14/Mar/2022 1:33 AM

Labels

Original: CVE-2021-43954 advisory advisory-to-release dont-import security

New: CVE-2021-43954 advisory advisory-released dont-import security

David Black made changes - 14/Mar/2022 1:33 AM

Labels

Original: advisory advisory-to-release dont-import security

New: CVE-2021-43954 advisory advisory-to-release dont-import security

David Black made changes - 14/Mar/2022 1:32 AM

Summary

Original: Internal SSRF via Non Admin - Server files/services/hosts enumeration

New: CVE-2021-43954: File and network resource enumeration via SSRF in DefaultRepositoryAdminService

David Black made changes - 14/Mar/2022 1:31 AM

Resolution		New: Fixed [ 1 ]
Security	Original: Atlassian Staff [ 10750 ]
Status	Original: Draft [ 12872 ]	New: Published [ 12873 ]

David Black made changes - 04/Mar/2022 2:32 AM

Description

Original: Affected versions of Atlassian Dev Tools allow remote attackers to access the content of internal network resources via a Server-Side Request Forgery (SSRF) vulnerability in {component}. When running in an environment like Amazon EC2, this flaw may be used to access to a metadata resource that provides access credentials and other potentially confidential information.

New: Affected versions of Atlassian Fisheye and Crucible allow remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability in the DefaultRepositoryAdminService class. When running in an environment like Amazon EC2, this flaw may be used to access to a metadata resource that provides access credentials and other potentially confidential information. The affected versions are before version 4.8.9.   *Affected versions:*  * version < 4.8.9 *Fixed versions:*  * 4.8.9

David Black made changes - 04/Mar/2022 2:22 AM

Link

New: This issue is related to CRUC-8520 [ CRUC-8520 ]

Load more older history items