CVE-2020-14192 - Vulnerability Details - OpenCVE

Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen response header from Atlassian Analytics. The affected versions are before version 4.8.4.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00196.

Key SSVC decision points have not yet been added.

Vendors	Products
Atlassian	Crucible Fisheye

Configuration 1 [-]

OR	cpe:2.3:a:atlassian:crucible::::::::
	cpe:2.3:a:atlassian:fisheye::::::::

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2020-6348	Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen response header from Atlassian Analytics. The affected versions are before version 4.8.4.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://jira.atlassian.com/browse/CRUC-8502
https://jira.atlassian.com/browse/FE-7334

History

No history.

MITRE

Status: PUBLISHED

Assigner: atlassian

Published: 2021-02-01T23:45:15.351944Z

Updated: 2024-09-16T16:14:04.913Z

Reserved: 2020-06-16T00:00:00

Link: CVE-2020-14192

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-02-02T00:15:12.320

Modified: 2024-11-21T05:02:50.390

Link: CVE-2020-14192

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Fisheye", "vendor": "Atlassian", "versions": [{"lessThan": "4.8.4", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Crucible", "vendor": "Atlassian", "versions": [{"lessThan": "4.8.4", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2020-11-11T00:00:00", "descriptions": [{"lang": "en", "value": "Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen response header from Atlassian Analytics. The affected versions are before version 4.8.4."}], "problemTypes": [{"descriptions": [{"description": "Information Disclosure", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-02-01T23:45:15", "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://jira.atlassian.com/browse/FE-7334"}, {"tags": ["x_refsource_MISC"], "url": "https://jira.atlassian.com/browse/CRUC-8502"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@atlassian.com", "DATE_PUBLIC": "2020-11-11T00:00:00", "ID": "CVE-2020-14192", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Fisheye", "version": {"version_data": [{"version_affected": "<", "version_value": "4.8.4"}]}}, {"product_name": "Crucible", "version": {"version_data": [{"version_affected": "<", "version_value": "4.8.4"}]}}]}, "vendor_name": "Atlassian"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen response header from Atlassian Analytics. The affected versions are before version 4.8.4."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Information Disclosure"}]}]}, "references": {"reference_data": [{"name": "https://jira.atlassian.com/browse/FE-7334", "refsource": "MISC", "url": "https://jira.atlassian.com/browse/FE-7334"}, {"name": "https://jira.atlassian.com/browse/CRUC-8502", "refsource": "MISC", "url": "https://jira.atlassian.com/browse/CRUC-8502"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T12:39:36.127Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://jira.atlassian.com/browse/FE-7334"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://jira.atlassian.com/browse/CRUC-8502"}]}]}, "cveMetadata": {"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "assignerShortName": "atlassian", "cveId": "CVE-2020-14192", "datePublished": "2021-02-01T23:45:15.351944Z", "dateReserved": "2020-06-16T00:00:00", "dateUpdated": "2024-09-16T16:14:04.913Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", "matchCriteriaId": "31A5B1B9-5B8B-4838-97C7-3287A715DA52", "versionEndExcluding": "4.8.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", "matchCriteriaId": "5ECD6A49-2A44-4220-97F1-E5D44BAFFF34", "versionEndExcluding": "4.8.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen response header from Atlassian Analytics. The affected versions are before version 4.8.4."}, {"lang": "es", "value": "Las versiones afectadas de Atlassian Fisheye y Crucible, permiten a atacantes remotos visualizar el SEN de un producto por medio de una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en el encabezado de respuesta x-asen de Atlassian Analytics. Las versiones afectadas son anteriores a 4.8.4"}], "id": "CVE-2020-14192", "lastModified": "2024-11-21T05:02:50.390", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-02-02T00:15:12.320", "references": [{"source": "security@atlassian.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/CRUC-8502"}, {"source": "security@atlassian.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/FE-7334"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/CRUC-8502"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/FE-7334"}], "sourceIdentifier": "security@atlassian.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}