CVE-2021-43957 - Vulnerability Details - OpenCVE

Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00182.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Atlassian	Crucible Fisheye

Configuration 1 [-]

OR	cpe:2.3:a:atlassian:crucible::::::::
	cpe:2.3:a:atlassian:fisheye::::::::

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2021-30819	Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://jira.atlassian.com/browse/CRUC-8524
https://jira.atlassian.com/browse/FE-7388

History

Mon, 07 Oct 2024 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: atlassian

Published: 2022-03-16T00:55:18.206995Z

Updated: 2024-10-04T18:50:25.464Z

Reserved: 2021-11-16T00:00:00

Link: CVE-2021-43957

Vulnrichment

Updated: 2024-08-04T04:10:17.200Z

NVD

Status : Modified

Published: 2022-03-16T01:15:07.877

Modified: 2024-11-21T06:30:05.067

Link: CVE-2021-43957

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Fisheye", "vendor": "Atlassian", "versions": [{"lessThan": "4.8.9", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Crucible", "vendor": "Atlassian", "versions": [{"lessThan": "4.8.9", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2022-03-14T00:00:00", "descriptions": [{"lang": "en", "value": "Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9."}], "problemTypes": [{"descriptions": [{"description": "Insecure Direct Object References (IDOR)", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-03-16T00:55:18", "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://jira.atlassian.com/browse/FE-7388"}, {"tags": ["x_refsource_MISC"], "url": "https://jira.atlassian.com/browse/CRUC-8524"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@atlassian.com", "DATE_PUBLIC": "2022-03-14T00:00:00", "ID": "CVE-2021-43957", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Fisheye", "version": {"version_data": [{"version_affected": "<", "version_value": "4.8.9"}]}}, {"product_name": "Crucible", "version": {"version_data": [{"version_affected": "<", "version_value": "4.8.9"}]}}]}, "vendor_name": "Atlassian"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Insecure Direct Object References (IDOR)"}]}]}, "references": {"reference_data": [{"name": "https://jira.atlassian.com/browse/FE-7388", "refsource": "MISC", "url": "https://jira.atlassian.com/browse/FE-7388"}, {"name": "https://jira.atlassian.com/browse/CRUC-8524", "refsource": "MISC", "url": "https://jira.atlassian.com/browse/CRUC-8524"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T04:10:17.200Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://jira.atlassian.com/browse/FE-7388"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://jira.atlassian.com/browse/CRUC-8524"}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-639", "lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "affected": [{"vendor": "atlassian", "product": "fisheye", "cpes": ["cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "4.8.9", "versionType": "custom"}]}, {"vendor": "atlassian", "product": "crucible", "cpes": ["cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "4.8.9", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-10-04T18:46:00.111042Z", "id": "CVE-2021-43957", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-04T18:50:25.464Z"}}]}, "cveMetadata": {"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "assignerShortName": "atlassian", "cveId": "CVE-2021-43957", "datePublished": "2022-03-16T00:55:18.206995Z", "dateReserved": "2021-11-16T00:00:00", "dateUpdated": "2024-10-04T18:50:25.464Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://jira.atlassian.com/browse/FE-7388", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://jira.atlassian.com/browse/CRUC-8524", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T04:10:17.200Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2021-43957", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-04T18:46:00.111042Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*"], "vendor": "atlassian", "product": "fisheye", "versions": [{"status": "affected", "version": "0", "lessThan": "4.8.9", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*"], "vendor": "atlassian", "product": "crucible", "versions": [{"status": "affected", "version": "0", "lessThan": "4.8.9", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-04T18:50:20.787Z"}}], "cna": {"affected": [{"vendor": "Atlassian", "product": "Fisheye", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "4.8.9", "versionType": "custom"}]}, {"vendor": "Atlassian", "product": "Crucible", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "4.8.9", "versionType": "custom"}]}], "datePublic": "2022-03-14T00:00:00", "references": [{"url": "https://jira.atlassian.com/browse/FE-7388", "tags": ["x_refsource_MISC"]}, {"url": "https://jira.atlassian.com/browse/CRUC-8524", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Insecure Direct Object References (IDOR)"}]}], "providerMetadata": {"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian", "dateUpdated": "2022-03-16T00:55:18"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "4.8.9", "version_affected": "<"}]}, "product_name": "Fisheye"}, {"version": {"version_data": [{"version_value": "4.8.9", "version_affected": "<"}]}, "product_name": "Crucible"}]}, "vendor_name": "Atlassian"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://jira.atlassian.com/browse/FE-7388", "name": "https://jira.atlassian.com/browse/FE-7388", "refsource": "MISC"}, {"url": "https://jira.atlassian.com/browse/CRUC-8524", "name": "https://jira.atlassian.com/browse/CRUC-8524", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Insecure Direct Object References (IDOR)"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2021-43957", "STATE": "PUBLIC", "ASSIGNER": "security@atlassian.com", "DATE_PUBLIC": "2022-03-14T00:00:00"}}}}, "cveMetadata": {"cveId": "CVE-2021-43957", "state": "PUBLISHED", "dateUpdated": "2024-10-04T18:50:25.464Z", "dateReserved": "2021-11-16T00:00:00", "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "datePublished": "2022-03-16T00:55:18.206995Z", "assignerShortName": "atlassian"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", "matchCriteriaId": "4D4FEF8B-76B5-4DB1-BC60-FE05BB918444", "versionEndExcluding": "4.8.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", "matchCriteriaId": "5C288EF9-2CF5-40F1-BC5E-C4C1EAE30B14", "versionEndExcluding": "4.8.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9."}, {"lang": "es", "value": "Las versiones afectadas de Atlassian Fisheye y Crucible permit\u00edan a atacantes remotos navegar por archivos locales por medio de una vulnerabilidad de Insecure Direct Object References (IDOR) en el directorio WEB-INF y omitir la correcci\u00f3n de CVE-2020-29446 debido a una falta de decodificaci\u00f3n de url. Las versiones afectadas son anteriores a la versi\u00f3n 4.8.9"}], "id": "CVE-2021-43957", "lastModified": "2024-11-21T06:30:05.067", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-03-16T01:15:07.877", "references": [{"source": "security@atlassian.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/CRUC-8524"}, {"source": "security@atlassian.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/FE-7388"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/CRUC-8524"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/FE-7388"}], "sourceIdentifier": "security@atlassian.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-639"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}