Описание
The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.
Ссылки
- Issue TrackingVendor Advisory
- Issue TrackingVendor Advisory
- Issue TrackingVendor Advisory
- Issue TrackingVendor Advisory
Уязвимые конфигурации
Одно из
EPSS
4.3 Medium
CVSS3
4 Medium
CVSS2
Дефекты
Связанные уязвимости
The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.
Уязвимость службы defaultrepositoryadmin инструмента проверки кода Crucible, инструмента поиска и сравнения кода Fisheye , позволяющая нарушителю осуществить SSRF-атаку
EPSS
4.3 Medium
CVSS3
4 Medium
CVSS2