Vulnerability Report

CVE-2017-9512

Title: Atlassian Crucible Information Disclosure

Information Disclosure

Proof Of Concept

No public PoC currently indexed for CVE-2017-9512.

CWE Category CWE-200

Published Date Aug 24, 2017

Modified Date Jun 17, 2026

Exploit Status Not Found

Score 7.5 CVSS v3.1

Exploit Probability (EPSS)

1.97%

Vulnerability Summary

CVE-2017-9512: The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks.

Impacted Vendors

atlassian 2

Reference Links

https://jira.atlassian.com/browse/CRUC-8053 https://jira.atlassian.com/browse/FE-6892 https://jira.atlassian.com/browse/CRUC-8053 https://jira.atlassian.com/browse/FE-6892

CVSS v3.1

Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0

Severity HIGH

7.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.0

Source Entity [email protected]

Severity HIGH

7.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

5.0

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:N/C:P/I:N/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns