CVE-2021-43958: 
Atlassian Fisheye & Crucible Analisi e mitigazione delle vulnerabilità

CVE-2021-43958 affects Fisheye and Crucible versions before 4.8.9. The vulnerability was discovered in various REST resources that failed to properly implement authentication controls, specifically not checking if users had exceeded their maximum failed login attempts limit which should trigger CAPTCHA verification (NVD).

The vulnerability is classified as an 'Improper Restriction of Excessive Authentication Attempts' (CWE-307). It has a CVSS v3.1 Base Score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS v2.0 Base Score of 7.5 (HIGH) (NVD).

The vulnerability allows remote attackers to perform brute force attacks against user login credentials by bypassing the CAPTCHA requirement that should be triggered after exceeding the maximum failed login attempts. This could lead to unauthorized access to user accounts (NVD).

The vulnerability has been fixed in Fisheye and Crucible version 4.8.9. Users are advised to upgrade to this version or later to address the security issue (Atlassian Advisory).