CVE-2020-4026 - The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from version 5.0.0 before 5.0.1, and from version 5.1.0 before 5.1.1 allows remote attackers to enumerate all linked applications, including those that are restricted or otherwise hidden, through an incorrect authorization check

Back Back to CVE browser

MEDIUM

The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from version 5.0.0 before 5.0.1, and from version 5.1.0 before 5.1.1 allows remote attackers to enumerate all linked applications, including those that are restricted or otherwise hidden, through an incorrect authorization check

Published Jun 2, 2020

4.3

MEDIUM

CVSS 3.1

EPSS 0.75%

Description

The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from version 5.0.0 before 5.0.1, and from version 5.1.0 before 5.1.1 allows remote attackers to enumerate all linked applications, including those that are restricted or otherwise hidden, through an incorrect authorization check.

Affected products

Vendor Atlassian Product Crucible Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <4.8.2
Vendor Atlassian Product Fisheye Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <4.8.2
Vendor Atlassian Product Navigator Links Default
n/a
- Version
  4.0.0
  Status
  affected
  Constraints
  <unspecified
- Version
  5.0.0
  Status
  affected
  Constraints
  <unspecified
- Version
  5.1.0
  Status
  affected
  Constraints
  <unspecified
- Version
  unspecified
  Status
  affected
  Constraints
  <3.2.23
- Version
  unspecified
  Status
  affected
  Constraints
  <4.3.7
- Version
  unspecified
  Status
  affected
  Constraints
  <5.0.1
- Version
  unspecified
  Status
  affected
  Constraints
  <5.1.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Atlassian

Crucible

n/a

Version	Status	Constraints
unspecified	affected	<4.8.2

Atlassian

Fisheye

n/a

Version	Status	Constraints
unspecified	affected	<4.8.2

Atlassian

Navigator Links

n/a

Version	Status	Constraints
4.0.0	affected	<unspecified
5.0.0	affected	<unspecified
5.1.0	affected	<unspecified
unspecified	affected	<3.2.23
unspecified	affected	<4.3.7
unspecified	affected	<5.0.1
unspecified	affected	<5.1.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-25291
Advisory
https://jira.atlassian.com/browse/CRUC-8485
x_refsource_MISCVendor Advisory
https://jira.atlassian.com/browse/FE-7299
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-25291		Advisory
https://jira.atlassian.com/browse/CRUC-8485		x_refsource_MISCVendor Advisory
https://jira.atlassian.com/browse/FE-7299		x_refsource_MISCVendor Advisory