CVE-2020-4018 - The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgery (CSRF) vulnerability

Back Back to CVE browser

HIGH

The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgery (CSRF) vulnerability

Published Jun 1, 2020

8.8

HIGH

CVSS 3.1

EPSS 0.57%

Description

The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgery (CSRF) vulnerability.

Affected products

Vendor Atlassian Product Crucible Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <4.8.1
Vendor Atlassian Product Fisheye Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <4.8.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Atlassian

Crucible

n/a

Version	Status	Constraints
unspecified	affected	<4.8.1

Atlassian

Fisheye

n/a

Version	Status	Constraints
unspecified	affected	<4.8.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-25283
Advisory
https://jira.atlassian.com/browse/CRUC-8471
x_refsource_MISCVendor Advisory
https://jira.atlassian.com/browse/FE-7287
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-25283		Advisory
https://jira.atlassian.com/browse/CRUC-8471		x_refsource_MISCVendor Advisory
https://jira.atlassian.com/browse/FE-7287		x_refsource_MISCVendor Advisory