Vulnerability Details : CVE-2021-43958

Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and therefore required solving a CAPTCHA in addition to providing user credentials for authentication via a improper restriction of excess authentication attempts vulnerability.
Published 2022-03-16 01:15:08
Updated 2022-03-22 16:02:30
Source Atlassian
View at NVD,   CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2021-43958

EPSS FAQ
0.53%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 76 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-43958

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.5
 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
 NIST
9.8
 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
 NIST

CWE ids for CVE-2021-43958

References for CVE-2021-43958

  • https://jira.atlassian.com/browse/FE-7387
    [FE-7387] CVE-2021-43958: Various rest resources missing CAPTCHA for failed user login attempts - Create and track feature requests for Atlassian products.
    Issue Tracking;Vendor Advisory
  • https://jira.atlassian.com/browse/CRUC-8523
    [CRUC-8523] CVE-2021-43958: Various rest resources missing CAPTCHA for failed user login attempts - Create and track feature requests for Atlassian products.
    Issue Tracking;Vendor Advisory

Products affected by CVE-2021-43958

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close