Fisheye and Crucible Multiple Vulnerabilities

Bugtraq ID:	45776
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 12 2011 12:00AM
Updated:	Jan 12 2011 12:00AM
Credit:	The vendor reported these issues.
Vulnerable:	Atlassian Fisheye 2.4.3 Atlassian Fisheye 2.3.7 Atlassian Fisheye 2.3.6 Atlassian Fisheye 2.3.5 Atlassian Fisheye 2.3.4 Atlassian Fisheye 2.3.3 Atlassian Fisheye 2.3.2 Atlassian Fisheye 2.3.1 Atlassian Fisheye 2.3.1 Atlassian Fisheye 2.3 Atlassian Fisheye 2.2.3 Atlassian Crucible 2.4.3 Atlassian Crucible 2.3.3 Atlassian Crucible 2.3.2 Atlassian Crucible 2.2.3
Not Vulnerable:	Atlassian Fisheye 2.4.4 Atlassian Crucible 2.4.4

Fisheye and Crucible Multiple Vulnerabilities

Fisheye and Crucible are prone to cross-site scripting, security-bypass, and information-disclosure vulnerabilities.

Attackers can exploit these issues to execute arbitrary script code in the context of the website, steal cookie-based authentication information, disclose sensitive information, or bypass certain security restrictions.

Fisheye and Crucible versions prior to 2.4.4 are vulnerable.

Fisheye and Crucible Multiple Vulnerabilities

An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.

Fisheye and Crucible Multiple Vulnerabilities

Solution:
Vendor updates are available. Please see the references for more information.

Fisheye and Crucible Multiple Vulnerabilities

References:

• Crucible Homepage (Atlassian)
  
• FishEye Homepage (Atlassian)
  
• FishEye and Crucible Security Advisory 2011-01-12 (Atlassian)
  
• FishEye and Crucible Security Advisory 2011-01-12 (Atlassian)