CVE-2017-9512: Infoleak
Published Aug 24, 2017
·Updated
The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks.
Affected Software
2 affected components
Atlassian Crucible<=4.4.0
Atlassian FishEye<=4.4.0
Event History
Aug 24, 2017
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-9512?
CVE-2017-9512 is considered a medium severity vulnerability since it allows anonymous attackers to access sensitive information.
2
How do I fix CVE-2017-9512?
To fix CVE-2017-9512, update Atlassian Fisheye and Crucible to version 4.4.1 or later.
3
What information can be exposed due to CVE-2017-9512?
CVE-2017-9512 may expose sensitive information such as email addresses of committers due to the lack of permission checks.
4
Which versions of Atlassian Fisheye are affected by CVE-2017-9512?
Versions of Atlassian Fisheye up to and including 4.4.0 are affected by CVE-2017-9512.
5
Which versions of Atlassian Crucible are affected by CVE-2017-9512?
Versions of Atlassian Crucible up to and including 4.4.0 are affected by CVE-2017-9512.