CVE-2020-4015 - The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a information disclosure vulnerability

Back Back to CVE browser

MEDIUM

The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a information disclosure vulnerability

Published Jun 1, 2020

4.3

MEDIUM

CVSS 3.1

EPSS 0.96%

Description

The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a information disclosure vulnerability.

Affected products

Vendor Atlassian Product Crucible Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <4.8.1
Vendor Atlassian Product Fisheye Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <4.8.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Atlassian

Crucible

n/a

Version	Status	Constraints
unspecified	affected	<4.8.1

Atlassian

Fisheye

n/a

Version	Status	Constraints
unspecified	affected	<4.8.1

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://jira.atlassian.com/browse/CRUC-8468
x_refsource_MISCThird Party Advisory
https://jira.atlassian.com/browse/FE-7284
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://jira.atlassian.com/browse/CRUC-8468		x_refsource_MISCThird Party Advisory
https://jira.atlassian.com/browse/FE-7284		x_refsource_MISCThird Party Advisory