CoreCVE
Back

MEDIUM

The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistics for it

Published Feb 2, 2018

Description

The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistics for it.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (2)

CWE-284

CWE-862

Missing Authorization

References (2)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner atlassian
Published Feb 2, 2018
Updated Sep 16, 2024
Reserved Jan 17, 2018
Link CVE-2017-18035
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2017-18035
Red Hat
Severity n/a
Public date n/a
Links CVE-2017-18035