CVE-2017-9512

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Aug 24, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-95135.4Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any C CVE-2017-95148.8Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restric CVE-2017-95165.4Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.CVE-2017-95178.8atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV.CVE-2017-95188.8atmail before 7.8.0.2 has CSRF, allowing an attacker to change the SMTP hostname and hijack all emails.CVE-2017-95198.8atmail before 7.8.0.2 has CSRF, allowing an attacker to create a user account.CVE-2017-95205.5The r_config_set function in libr/config/config.c in radare2 1.5.0 allows remote attackers to cause a denial of service (use-after-free and CVE-2017-95219.8The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939 CVE-2017-95227.5The Time Warner firmware on Technicolor TC8717T devices sets the default Wi-Fi passphrase to a combination of the SSID and BSSID, which make CVE-2017-95236.1The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342.CVE-2017-95247.5The qemu-nbd server in QEMU (aka Quick Emulator), when built with the Network Block Device (NBD) Server support, allows remote attackers to CVE-2017-95256.7In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-c