Atlassian Crucible Server < 3.10.0 Multiple Vulnerabilities

medium Nessus Network Monitor Plugin ID 9782

Synopsis

The remote Crucible server is affected by multiple attack vectors.

Description

Versions of Crucible prior to 3.10.0 are affected by multiple vulnerabilities :

- An unspecified flaw may allow an attacker to bypass Cross-Site Request Forgery (CSRF) protection mechanisms and conduct CSRF attacks. No further details have been provided by the vendor.
- A flaw exists as HTTP requests to certain pages do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a CSRF/XSRF attack causing the victim to perform backup actions that may overwrite the existing backup file.
- A flaw exists that is triggered when handling HTTP requests containing newline characters. This may allow a remote attacker to inject forged content into log files.

Solution

Upgrade to Crucible version 3.10.0 or later.

Plugin Details

Severity: Medium

ID: 9782

Family: CGI

Published: 11/18/2016

Updated: 3/6/2019

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 5.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:atlassian:crucible

Patch Publication Date: 10/28/2015

Vulnerability Publication Date: 12/1/2015

Detections

Analytics