Atlassian Crucible Server 3.9.x < 3.9.2 Multiple Vulnerabilities

medium Nessus Network Monitor Plugin ID 9781


The remote Crucible server is affected by multiple attack vectors.


Versions of Crucible 3.9.x prior to 3.9.2 are affected by multiple vulnerabilities :

- An unspecified flaw may allow an attacker to bypass Cross-Site Request Forgery (CSRF) protection mechanisms and conduct CSRF attacks. No further details have been provided by the vendor.
- A flaw exists that is triggered when handling HTTP requests containing newline characters. This may allow a remote attacker to inject forged content into log files.
- A flaw exists in the REST API that may allow a remote attacker to gain unauthorized access to a review of the patch list and the contents of patches.


Upgrade to Crucible version 3.9.2 or later.

See Also

Plugin Details

Severity: Medium

ID: 9781

Family: CGI

Published: 11/18/2016

Updated: 3/6/2019

Dependencies: 9571

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 5

Temporal Score: 4.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

CVSS v3.0

Base Score: 5.3

Temporal Score: 5.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*

Patch Publication Date: 10/28/2015

Vulnerability Publication Date: 12/1/2015