Wiz
Vulnerability DatabaseCVE-2021-43958

CVE-2021-43958: 
Atlassian Fisheye & Crucible vulnerability analysis and mitigation

Overview

CVE-2021-43958 affects Fisheye and Crucible versions before 4.8.9. The vulnerability was discovered in various REST resources that failed to properly implement authentication controls, specifically not checking if users had exceeded their maximum failed login attempts limit which should trigger CAPTCHA verification (NVD).

Technical details

The vulnerability is classified as an 'Improper Restriction of Excessive Authentication Attempts' (CWE-307). It has a CVSS v3.1 Base Score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS v2.0 Base Score of 7.5 (HIGH) (NVD).

Impact

The vulnerability allows remote attackers to perform brute force attacks against user login credentials by bypassing the CAPTCHA requirement that should be triggered after exceeding the maximum failed login attempts. This could lead to unauthorized access to user accounts (NVD).

Mitigation and workarounds

The vulnerability has been fixed in Fisheye and Crucible version 4.8.9. Users are advised to upgrade to this version or later to address the security issue (Atlassian Advisory).

Additional resources

Source: This report was generated using AI

Related Atlassian Fisheye & Crucible vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2022-26136CRITICAL9.8
  • BambooBamboo
  • cpe:2.3:a:atlassian:confluence
NoYesJul 20, 2022
CVE-2021-43958CRITICAL9.8
  • Atlassian Fisheye & CrucibleAtlassian Fisheye & Crucible
  • cpe:2.3:a:atlassian:fisheye
NoYesMar 16, 2022
CVE-2024-21683HIGH8.8
  • Atlassian Fisheye & CrucibleAtlassian Fisheye & Crucible
  • cpe:2.3:a:atlassian:fisheye
NoYesMay 21, 2024
CVE-2022-26137HIGH8.8
  • BambooBamboo
  • cpe:2.3:a:atlassian:confluence
NoYesJul 20, 2022
CVE-2021-43957HIGH7.5
  • Atlassian Fisheye & CrucibleAtlassian Fisheye & Crucible
  • cpe:2.3:a:atlassian:crucible
NoYesMar 16, 2022

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo