CVE-2020-4026 Missing authorization in Crucible
Remote attackers can enumerate all linked applications, including hidden ones, due to incorrect authorization checks in Atlassian Navigator Links.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-4026?
CVE-2020-4026 is a medium-severity missing authorization vulnerability in Atlassian Crucible, published on 2 Jun 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from version 5.0.0 before 5.0.1, and from version 5.1.0 before 5.1.1 allows remote attackers to enumerate all linked applications, including those that are restricted or otherwise hidden, through an incorrect authorization check.
Weakness: CWE-863
Which versions are affected by CVE-2020-4026?
It affects 1 product.
Products include Atlassian Navigator Links.
How do I fix CVE-2020-4026?
No fix has been published for CVE-2020-4026 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-4026 being exploited?
There is no known exploitation of CVE-2020-4026 in the wild and no public exploit code.
Sources
Also known as GHSA-5x3c-hcgh-mgxq.