CVE-2017-9512

The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks.

Score

CVSS 3.1 7.5 High

Status

Modified - security@atlassian.com

Published

2017-08-24

Last modified

2024-10-16

Weaknesses

CWE-200, CWE-284

Affected products

• Atlassian Fisheye And Crucible (Atlassian)
• Crucible (Atlassian)
• Fisheye (Atlassian)

References

• https://jira.atlassian.com/browse/CRUC-8053
• https://jira.atlassian.com/browse/FE-6892