| Vulnerability Name: | CCN-71428 | ||||||
| Published: | 2011-11-20 | ||||||
| Updated: | 2011-11-20 | ||||||
| Summary: | FishEye and Crucible could allow a remote attacker to bypass security restrictions, caused by the failure to restrict access to changesets or reviews. An attacker could exploit this vulnerability using tooltips to read metadata from repositories or projects. | ||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
| ||||||
| CVSS v2 Severity: | 5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N) 3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
| ||||||
| Vulnerability Consequences: | Bypass Security | ||||||
| References: | Source: CCN Type: FishEye and Crucible Security Advisory 2011-11-22 FishEye 2.7 Documentation Source: CCN Type: SA46975 FishEye / Crucible Security Bypass Security Issue and Script Insertion Vulnerabilities Source: CCN Type: Atlassian Web site Crucible Source: CCN Type: BID-50762 FishEye and Crucible Multiple HTML Injection and Unauthorized Access Vulnerabilities Source: XF Type: UNKNOWN fisheye-changesets-security-bypass(71428) | ||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||
| BACK | |||||||