CVE-2017-9512 Missing authorization in Atlassian Fisheye and Crucible
Anonymous attackers can access sensitive committer information due to missing permission checks in Atlassian Fisheye and Crucible.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-9512?
CVE-2017-9512 is a high-severity missing authorization vulnerability in Atlassian Crucible, published on 24 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks.
Weakness: CWE-200
Which versions are affected by CVE-2017-9512?
It affects 2 products.
Products include Atlassian Crucible, Atlassian Fisheye.
How do I fix CVE-2017-9512?
No fix has been published for CVE-2017-9512 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2017-9512 being exploited?
There is no known exploitation of CVE-2017-9512 in the wild and no public exploit code.
Other vulnerabilities in Atlassian Crucible
Sources
Also known as GHSA-fp8m-5h9q-mjmp.