CVE-2020-29446

Published: Jan 18, 2021Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory. The affected versions are before version 4.8.5.

Affected (2)

Products: Atlassian: Crucible, Fisheye

Atlassian

2 products

Crucible

Fisheye

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Atlassian Crucible	Before 4.8.5
Atlassian Fisheye	Before 4.8.5

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (4)

https://jira.atlassian.com/browse/CRUC-8496

Source: security@atlassian.com

Issue TrackingVendor Advisory

https://jira.atlassian.com/browse/FE-7326

Source: security@atlassian.com

Issue TrackingVendor Advisory

https://jira.atlassian.com/browse/CRUC-8496

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://jira.atlassian.com/browse/FE-7326

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.