CVE-2018-13399

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
Atlassian	Fisheye and Crucible	>= unspecified, < 4.6.1

References

https://jira.atlassian.com/browse/CRUC-8314Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/FE-7105Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/CRUC-8314Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/FE-7105Issue Tracking, Vendor Advisory

Timeline

Published: Oct 16, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-13407.5Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, wh CVE-2018-134004.7Several administrative resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before CVE-2018-134016.1The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before vers CVE-2018-134026.1Many resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, fro CVE-2018-134035.4The two-dimensional filter statistics gadget in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.12.4, and from ver CVE-2018-134044.1The VerifyPopServerConnection resource in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.7.5, from version 7.8.0 CVE-2018-134057.8The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group own CVE-2018-134067.8An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c in the Linux kernel before 4.17.4 could result in local CVE-2018-134074.9A CSRF issue was discovered in Jirafeau before 3.4.1. The "delete file" feature on the admin panel is not protected against automated reques CVE-2018-134086.1An issue was discovered in Jirafeau before 3.4.1. The "search file by link" form is affected by reflected XSS that could allow, by targeting CVE-2018-134096.1An issue was discovered in Jirafeau before 3.4.1. The "search file by hash" form is affected by reflected XSS that could allow, by targeting CVE-2018-134109.8Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and applica