Vulnerability in Atlassian Crucible

CVE-2020-29446

Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory. The affected versions are before version 4.8.5.

EPSS: 0.004 (60.4th percentile) — read the EPSS interpretation.

Affected products

Atlassian Crucible — versions unspecified
Atlassian Fisheye — versions unspecified

References

jira.atlassian.com/browse/CRUC-8496 (x_refsource_MISC)
jira.atlassian.com/browse/FE-7326 (x_refsource_MISC)