Atlassian FishEye 3.x < 3.0.4 / 3.1.7 / 3.2.5 / 3.3.4 / 3.4.4 Administrator Password Reset

high Nessus Plugin ID 77159

Language:

Synopsis

The version of Atlassian FishEye installed on the remote host is potentially affected by an administrator password reset flaw.

Description

According to its self-reported version, the installation of Atlassian FishEye running on the remote host is potentially affected by a flaw in which a remote, unauthenticated user is able to set the 'admin' user for FishEye to an arbitrary value. This can allow an attacker to gain administrative access to the application.

Solution

Upgrade to FishEye 3.0.4 / 3.1.7 / 3.2.5 / 3.3.4 / 3.4.4 or later.

Plugin Details

Severity: High

ID: 77159

File Name: fisheye_3_0_4.nasl

Version: 1.8

Type: remote

Family: CGI abuses

Published: 8/12/2014

Updated: 6/5/2024

Configuration: Enable paranoid mode, Enable thorough checks

Supported Sensors: Nessus

Enable CGI Scanning: true

Vulnerability Information

CPE: cpe:/a:atlassian:fisheye

Required KB Items: Settings/ParanoidReport, installed_sw/fisheye

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No known exploits are available

Patch Publication Date: 5/21/2014

Vulnerability Publication Date: 5/14/2014

Reference Information

BID: 67618

Detections

Analytics