CVE-2021-43954

The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
atlassianCNA
---
---
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 35%
VendorProductVersion
atlassiancrucible
𝑥
< 4.8.9
atlassianfisheye
𝑥
< 4.8.9
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://jira.atlassian.com/browse/CRUC-8520
https://jira.atlassian.com/browse/FE-7384
https://jira.atlassian.com/browse/CRUC-8520
https://jira.atlassian.com/browse/FE-7384