CVE-2018-13398

Опубликовано: 18 сент. 2018

Источник: nvd

CVSS3: 6.5

CVSS2: 4.3

EPSS Низкий

Описание

The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery (CSRF) vulnerability.

Ссылки

https://jira.atlassian.com/browse/CRUC-8312
Third Party Advisory
https://jira.atlassian.com/browse/FE-7100
Third Party Advisory
https://jira.atlassian.com/browse/CRUC-8312
Third Party Advisory
https://jira.atlassian.com/browse/FE-7100
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*

Версия до 4.5.4 (исключая)

cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*

Версия до 4.5.4 (исключая)

EPSS

Процентиль: 34%

0.00136

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-9xj3-f33j-rv5m