CVE-2021-43954

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Mar 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-439554.3The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain inf CVE-2021-439566.1The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or Java CVE-2021-439577.5Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (I CVE-2021-439589.8Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest r CVE-2021-439595.7Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of CVE-2021-43964.3The Rucy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.4.4. This is due to missing or CVE-2021-439604.8Lorensbergs Connect2 3.13.7647.20190 is affected by an XSS vulnerability. Exploitation requires administrator privileges and is performed th CVE-2021-439614.3Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection.CVE-2021-439638.1An issue was discovered in Couchbase Sync Gateway 2.7.0 through 2.8.2. The bucket credentials used to read and write data in Couchbase Serve CVE-2021-439696.5The login.jsp page of Quicklert for Digium 10.0.0 (1043) is affected by both Blind SQL Injection with Out-of-Band Interaction (DNS) and Blin CVE-2021-43974.3The Staff Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6. This is d CVE-2021-439708.8An arbitrary file upload vulnerability exists in albumimages.jsp in Quicklert for Digium 10.0.0 (1043) via a .mp3;.jsp filename for a file t