Vulnerability · Published Jan 18, 2021 · Assigned by atlassian

CVE-2020-29446

Medium 5.3

In plain English

A medium-severity security flaw in Crucible from Atlassian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS NVD)5.3Medium

Exploit odds (30 days)1.2%top 31.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory. The affected versions are before version 4.8.5.

Affected products (as reported)

Vendor	Product	Versions
Atlassian	Fisheye	unspecified – before 4.8.5
Atlassian	Crucible	unspecified – before 4.8.5

References

https://jira.atlassian.com/browse/CRUC-8496 x_refsource_MISC
https://jira.atlassian.com/browse/FE-7326 x_refsource_MISC