CVE-2020-29447

Affected versions of Atlassian Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the file upload request feature of code reviews. The affected versions are before version 4.7.4, and from version 4.8.0 before 4.8.5.

CVSS v3 4.3 MEDIUM
CVSS v2.0 4.0 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://jira.atlassian.com/browse/CRUC-8505	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:atlassian:crucible::::::::
	cpe:2.3:a:atlassian:crucible::::::::

History

No history.

Information

Published : 2020-12-21 01:15

Updated : 2023-12-10 13:41

NVD link : CVE-2020-29447

Mitre link : CVE-2020-29447

CVE.ORG link : CVE-2020-29447

JSON object : View

Products Affected

atlassian

crucible

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2020-29447", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2020-12-21T01:15:12.457", "references": [{"url": "https://jira.atlassian.com/browse/CRUC-8505", "tags": ["Vendor Advisory"], "source": "security@atlassian.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Affected versions of Atlassian Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the file upload request feature of code reviews. The affected versions are before version 4.7.4, and from version 4.8.0 before 4.8.5."}, {"lang": "es", "value": "Las versiones afectadas de Atlassian Crucible permiten a atacantes remotos impactar la disponibilidad de la aplicaci\u00f3n por medio de una vulnerabilidad de Denegaci\u00f3n de Servicio (DoS) en la funcionalidad file upload request de las revisiones de c\u00f3digo. Las versiones afectadas son anteriores a versi\u00f3n 4.7.4 y desde versi\u00f3n 4.8.0 anteriores a 4.8.5"}], "lastModified": "2020-12-22T19:55:47.367", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "24C4E63E-81F5-4417-9658-D5ED5C7E0A06", "versionEndExcluding": "4.7.4"}, {"criteria": "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3EFA83E6-DBA1-41B4-8A07-0BAF6845AA08", "versionEndExcluding": "4.8.5", "versionStartIncluding": "4.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@atlassian.com"}