CVE-2021-43957

Published: Mar 16, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9.

Affected (2)

Products: Atlassian: Crucible, Fisheye

2 products

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Atlassian Crucible	Before 4.8.9
Atlassian Fisheye	Before 4.8.9

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (4)

https://jira.atlassian.com/browse/CRUC-8524

Source: security@atlassian.com

Issue TrackingVendor Advisory

https://jira.atlassian.com/browse/FE-7388

Source: security@atlassian.com

Issue TrackingVendor Advisory

https://jira.atlassian.com/browse/CRUC-8524

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://jira.atlassian.com/browse/FE-7388

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.