CVE-2020-4017: 
Atlassian Fisheye & Crucible vulnerability analysis and mitigation

The vulnerability CVE-2020-4017 affects Atlassian Fisheye and Crucible versions before 4.8.1. This information disclosure vulnerability was discovered in April 2020 and involves the /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin (Atlassian Jira).

The vulnerability exists in the crucible-jira-ril plugin's /rest/jira-ril/1.0/jira-rest/applinks resource endpoint. The issue allows remote attackers to obtain information about configured Jira application links through an information disclosure vulnerability. The severity of this vulnerability is classified as Medium according to CVSS scoring (Atlassian Jira).

When exploited, this vulnerability enables remote attackers to access information about any configured Jira application links in the affected systems. This information disclosure could potentially provide attackers with insights into the internal system configuration (Atlassian Jira).

The vulnerability can be exploited remotely by accessing the affected endpoint in systems running Atlassian Fisheye and Crucible versions prior to 4.8.1 (Atlassian Jira).

The vulnerability has been fixed in Atlassian Fisheye and Crucible version 4.8.1. Users are advised to upgrade to this version or later to mitigate the security risk (Atlassian Jira).